Author Topic: Win64:Evo-gen (susp)  (Read 38796 times)

0 Members and 1 Guest are viewing this topic.

FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #15 on: May 21, 2014, 09:51:25 PM »
And the MBAM scan....

I'll only be online for next 3 hours so hopefully can sort it before then :-)

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Win64:Evo-gen (susp)
« Reply #16 on: May 21, 2014, 11:05:10 PM »
I've asked a remover to help you.
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #17 on: May 21, 2014, 11:14:15 PM »
I've asked a remover to help you.

Thank you. I took a risk and deleted the files....

Just doing full and long (3 hour) scan with MBAM at moment, and it hasn't picked up the virus like it did before (got a pop up from avast when did that). I guess the avast temp files was ok to delete?

Also if MBAM and Avast and Super-anti-spyware don't find anything. I should be fine now? As I want to sort is asap then can change the passwords I used for my banking, email, eBay etc

Still have no idea how I got it, as stick to safe websites!
« Last Edit: May 22, 2014, 12:00:25 AM by FalseTime »

FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #18 on: May 22, 2014, 12:14:24 AM »
I've asked a remover to help you.

Thank you. I took a risk and deleted the files....

Just doing full and long (3 hour) scan with MBAM at moment, and it hasn't picked up the virus like it did before (got a pop up from avast when did that). I guess the avast temp files was ok to delete?

Also if MBAM and Avast and Super-anti-spyware don't find anything. I should be fine now? As I want to sort is asap then can change the passwords I used for my banking, email, eBay etc

Still have no idea how I got it, as stick to safe websites!


Also was the logs clean?

Thanks

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Win64:Evo-gen (susp)
« Reply #19 on: May 22, 2014, 02:12:29 AM »
I haven't recieved any training. That's part of the reason why I can't fully help you. And that's also why I asked someone else to help you. Wait for their reply tomorrow and they should be able to help.
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #20 on: May 22, 2014, 10:29:31 AM »
I haven't recieved any training. That's part of the reason why I can't fully help you. And that's also why I asked someone else to help you. Wait for their reply tomorrow and they should be able to help.

Oh I see, thank you anyway

 So a update, deleted the files in the chest. Did the full scan with MBAM before I went to bed, and that was clean. Just doing a full Avast scan (has come back clean), and then I'll do a full scan with Superantispyware (that was clean to)
(also my virus total link is still showing as clean????)

MBAM didn't trigger the virus again with Avast, so I hope it should all come back clean!

Also I been getting a Adobe download warning with Avast lately (svchost.exe), It every-time there's a update with flash etc though. So just a thought! Also I found a thread saying this virus is a well known false pos with Avast?

Really appreciate the help. I am careful online and use loads of software, but I guess. Sometimes you get caught out. I also use Comodo with Hips and Spyware Blaster

I'm also going to try Eset online scanner, disable avast shields and Comodo hips yeah?
« Last Edit: May 22, 2014, 01:18:21 PM by FalseTime »

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Win64:Evo-gen (susp)
« Reply #21 on: May 22, 2014, 08:20:38 PM »
svchost.exe. Open Task Manager. Who is running it? NETWORK SERVICE, or SYSTEM or [User Account Name Here]

As far as I can tell, you're fine. Not sure why no-one answered.
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #22 on: May 22, 2014, 08:40:57 PM »
svchost.exe. Open Task Manager. Who is running it? NETWORK SERVICE, or SYSTEM or [User Account Name Here]

As far as I can tell, you're fine. Not sure why no-one answered.

Thanks Michael. I hate having a virus on my system, even if in chest. I just want rid and it sorted. I still have no idea how I caught it, as only used ebay and aol that day. And definitely wasn't a dodgy email.

svchost.exe I have 10 processes on that, 2 is for network service, 4 is for local service, and 4 is for system. And they all say there host process for windows services!

I have also done a Trend Micro Housecall with avast shields disabled, and comodos hips disabled and that was normal to.

So guess I'm all ok now? As the scans are fine



« Last Edit: May 22, 2014, 08:44:15 PM by FalseTime »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37506
  • Not a avast user
Re: Win64:Evo-gen (susp)
« Reply #23 on: May 22, 2014, 09:45:49 PM »
Quote
    Thanks Michael. I hate having a virus on my system,   
as said in my reply #7 you have a suspicious file ...... not malware yet


virustotal file info

Quote
    CopyrightCopyright (C) 2009 Acer Inc.
Publisher Acer Inc.
Product LaunchAlaunchX Application
Original name LaunchAlaunchX.exe
Internal name LaunchAlaunchX
File version 3, 0, 0, 10
Description Acer GAIA LaunchAlaunchX
Comments RTM version


FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #24 on: May 22, 2014, 10:27:01 PM »
Quote
    Thanks Michael. I hate having a virus on my system,   
as said in my reply #7 you have a suspicious file ...... not malware yet


virustotal file info

Quote
    CopyrightCopyright (C) 2009 Acer Inc.
Publisher Acer Inc.
Product LaunchAlaunchX Application
Original name LaunchAlaunchX.exe
Internal name LaunchAlaunchX
File version 3, 0, 0, 10
Description Acer GAIA LaunchAlaunchX
Comments RTM version

Sorry, so that mean in a way it was a false pos?

Everything seems ok since I deleted the file's in the chest and scans are all clear! I just do quite a bit of banking etc. So get a bit paranoid when get alerts!

Offline Michael (alan1998)

  • Massive Poster
  • ****
  • Posts: 2768
  • Volunteer
Re: Win64:Evo-gen (susp)
« Reply #25 on: May 22, 2014, 11:08:59 PM »
Hi, I cannot help you further. It'd have to be taken up by a hexpert. However, given that VT scan, and it being an Acer File, I'd say FP/
VOLUNTEER

Senior Security Analyst; Sys Admin (Linux); Forensics/Incident Response.

Security is a mindset, not an application. Think BEFORE you click.

FalseTime

  • Guest
Re: Win64:Evo-gen (susp)
« Reply #26 on: May 22, 2014, 11:23:36 PM »
Ah thanks so much, you all been really helpful

It's put my mind at ease now :-)