Malware Removal Forums

Malware infection similar to "Antivirus System Pro"

via · 2011-01-22T18:30:50+00:00

I tried posting this yesterday, but I did it wrong. Here's the new and improved version of my cry for help: Yesterday, I got hit with a virus on my main computer. These are the symptoms. (I've bolded the text that comes from the actual malware program.) 1. Every time I try to open a program, I get a "Security Error" warning telling me the "Application cannot be executed. The file ****.exe is infected. Do you want to activate your antivirus software now?" In Safe Mode, I can open and run the programs. 2. When I click on any browser (IE, Opera, Chrome), it gives me an "Internet Explorer Warning" and tells me that my computer is infected and that I need to purchase antivirus software. It denies me internet access. Porn sites regularly come up. I've somehow found a way to access the internet through Firefox by messing with Firefox's proxy settings. However, I'm often redirected to random websites when I'm searching for stuff online. 3. I get "Spyware" alerts asking me to purchase software.

22 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

deltalima Admin/Teacher

January 27, 2011, 8:20 PM UTC

Hi via,

I noticed that when I open "My Documents", I see transparent icons that start with the "~" or "~$" symbols. Is that normal?

That sounds like temporary files that are hidden, they should not show once you have run OTL cleanup. If they still show then

Open Windows Explorer by right-clicking the Start button and left clicking Explore
Then select the Tools menu and click Folder Options
Select the View Tab, Under the Hidden files and folders heading select Do not show hidden files and folders
Check the Hide protected operating system files (recommended) option
Click OK

I have an external hard drive on which I backed up all my files. Should I have scanned that hard drive with any of the tools you suggested in this thread?

A full scan with your antivirus should be sufficient.

When I ran WinPatrol, it said "A change had been detected in the following Registry Location which you've asked to be monitored. Is changing this value OK? Software]Microsoft\Internet Explorer\Download CheckExeSignatures:no" Should I click "Yes" or "No" for that?

Click Yes.

via

January 28, 2011, 3:06 AM UTC

Hi deltalima,

I uninstalled Avast and installed my preferred antivirus program, Webroot's Spy Sweeper with Antivirus. I decided to run a scan, just to see if anything would come up. It did.

This is what it detected:

about cookie
ic-live cookie
Troj/FFAdRedr-A
Troj/JavaDI-BE
trojan-downloader-karagany

As you can see, there are three trojans that none of the other programs picked up. I also got some sort of warning while trying to access a Webroot's blog, which contained information about the third trojan. The first was that a program on my computer was blocking "google.ad.sgdoubleclick.net". Later, a message on a browser window popped up: "Navigation to the webpage was canceled. What you can try: Refresh the page."

I also scanned my external hard drive on a clean computer using Webroot's Spy Sweeper with Anti-virus, and found a Troj/JsInject-A on it.

Should I run new programs to get these off my system?

deltalima Admin/Teacher

January 28, 2011, 8:31 AM UTC

Should I run new programs to get these off my system?

No, please post the log from Webroot with details of the detections.

via

January 28, 2011, 5:05 PM UTC

Hi deltalima,

I can't seem to find the .txt log. I looked under "Program Files." I also looked under the Webroot folder, but I found nothing.

The following stuff I copied by hand:

-Troj/FFAd-Redr-A
c:\documents and settings\owner\local settings\application data\{8c1ed365-1623-474a-a1c8-848669cfbd75}\chrome\content\overlay.xul

-Troj/JavaDl-BE
c:\documents and settings\owner\doctorweb\quarantine\4c997ec4-45b314d2

-trojan-downloader-karagany
C:\Documents and Settings\Owner\Application Data\Adobe\plugs

Webroot doesn't offer email customer service. I'll wait for your instructions before I call them and ask them where this log is. (If you want me to post the cookie locations, let me know...)

deltalima Admin/Teacher

January 28, 2011, 6:10 PM UTC

Hi via,

It's safe to let Webroot remove those files, then you will be good to go.

Any further questions?

Cypher Admin/Teacher

January 29, 2011, 3:11 PM UTC

As this issue appears to be resolved,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.