« previous next »
Pages: 1 [2] 3 4   Go Down

Author Topic: what to do if a trojan is found in system restore?  (Read 26165 times)

0 Members and 1 Guest are viewing this topic.

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #15 on: August 17, 2009, 08:42:04 PM »
One more time Trojans found in System Restore by MBAM.

I am unable to trace why it is happening again and again in System Restore.

I am surprised that SAS detected Comodo Memory Firewall infected files may be False Positive

samnetx
« Last Edit: October 02, 2009, 09:19:56 AM by samnetx »
Logged

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #16 on: September 23, 2009, 10:25:08 PM »
Found something in System Restore again.
View the screenshot

How to send Quarantined files of Malwarebytes Antimalware to VirusTotal?

I searched for the infected file to be send to Virustotal for analysis which I have Quarantined earlier in MBAM but I am unable to search the same in my Hard disk.

Give me information to send file to virustotal which I have quarantined earlier in MBAM.

Tell me if I can enable the MBAM protection module after purchasing, I think it has no conflicts with avast.

samnetx 
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: what to do if a trojan is found in system restore?
« Reply #17 on: September 23, 2009, 10:36:59 PM »
Quote from: samnetx on September 23, 2009, 10:25:08 PM
How to send Quarantined files of Malwarebytes Antimalware to VirusTotal?
You can't, as it just allow restore and not extract to a different folder.
I won't worry that much. If it is a false positive, it's ok, you just broke that system restore point.
If it is infected, the system restore point is broken now, you can't use it.

Quote from: samnetx on September 23, 2009, 10:25:08 PM
Tell me if I can enable the MBAM protection module after purchasing, I think it has no conflicts with avast.
At least with version 4.8 of avast, MBAM resident is compatible.
Most probably it will be compatible also with avast 5 (not sure).
Logged
The best things in life are free.

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #18 on: September 25, 2009, 12:39:12 AM »
Here is a VirusTotal of the infected file. It is Riskware and Trojan
(edit) I have used this software BPS Spyware Remover (Riskware) in the past as a Spyware Remover (downloaded from internet) and my computer crashed two time in two years. I recently deleted its files from the harddisk.

http://www.virustotal.com/analisis/1b90b4b5493533b0d42f36608f3850630a4df57ce4ebe85ddf65973ec3ca4fe0-1253830470

Give me your valuable suggestion, how to get rid of System Restore virus, trojans which are always found after few days.

samnetx
« Last Edit: September 25, 2009, 12:57:00 AM by samnetx »
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: what to do if a trojan is found in system restore?
« Reply #19 on: September 25, 2009, 01:54:20 AM »
Disable System Restore on Windows ME, XP or Vista. After disabling you can enable it again.
Logged
The best things in life are free.

samnetx

  • Guest
What to do if a Trojan is found ?
« Reply #20 on: October 01, 2009, 05:24:42 PM »
Trojans found
I scan my computer with MBAM regularly, today after updating my MBAM and then scanning I found Trojan in my computer.

Here is screen view of found Trojan
Trojan.Agent according to MBAM  
I have recent OS history of infected folder with this one but at that time the scans with MBAM may not be able to detect this.

file anaysis
http://www.virustotal.com/analisis/f05e0b9a6e426f1db6a3b6dab4d6c726b10901cd549524923b3703d390444ab9-1254239735

Give me information about more websites to scan infected files for analysis.

samnetx
« Last Edit: October 01, 2009, 05:30:55 PM by samnetx »
Logged

Offline nmb

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3054
Re: what to do if a trojan is found in system restore?
« Reply #21 on: October 01, 2009, 05:31:29 PM »
Hello samnetx see this:

it'll solve your problem http://forum.avast.com/index.php?topic=49100.0
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89064
  • No support PMs thanks
Re: what to do if a trojan is found in system restore?
« Reply #22 on: October 01, 2009, 05:39:25 PM »
I would say do nothing for now as these are the subject of an FP report by MBAM users.

Since you have quarantined these I would restore these so that avast will be able to use the actskin4.ocx.

It is always best to check to see if others have this problem, which nmb has posted.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #23 on: October 01, 2009, 07:41:26 PM »
My avast home is started after quarantine of these files every time I start my computer.

You can view the image.

There are some enteries found by my registry cleaner may be relating to this file.

samnetx
« Last Edit: October 01, 2009, 07:44:33 PM by samnetx »
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89064
  • No support PMs thanks
Re: what to do if a trojan is found in system restore?
« Reply #24 on: October 01, 2009, 07:53:13 PM »
Do as I said earlier, restore the recent detections from Quarantine. Update to the latest MBAM database version 2886, which corrects this.

It is hardly surprising the registry cleaner finds this as you have them in quarantine.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #25 on: October 01, 2009, 08:13:29 PM »
When I found my avast running in services I deleted the quarantined files

Now what to do about this.

samnetx
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: what to do if a trojan is found in system restore?
« Reply #26 on: October 01, 2009, 08:37:52 PM »
Quote from: samnetx on October 01, 2009, 08:13:29 PM
When I found my avast running in services I deleted the quarantined files

Now what to do about this.

samnetx
Can you try to repair your installation?
Go to Control Panel > Add/Remove programs > avast! antivirus > Remove. Then choose Repair function in the popup window (Repair).
If this does not help, can you uninstall / boot / install / boot again?
Logged
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89064
  • No support PMs thanks
Re: what to do if a trojan is found in system restore?
« Reply #27 on: October 01, 2009, 09:19:56 PM »
Quote from: samnetx on October 01, 2009, 08:13:29 PM
When I found my avast running in services I deleted the quarantined files

It is never advisable to delete in haste (you have no options left, leave them in quarantine whilst you investigate) as you can regret at leisure.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #28 on: October 01, 2009, 09:52:36 PM »
Downloaded the latest version 4.8.1356 of avast home

I have repaired the installation of avast home

The file is now available in system32 folder (edit) and new file is not infected scanned with MBAM(Database Version 2887). It was False Positive earlier shown by MBAM in previous scan scanned with database version 2880.


samnetx
« Last Edit: October 02, 2009, 02:28:54 PM by samnetx »
Logged

samnetx

  • Guest
Re: what to do if a trojan is found in system restore?
« Reply #29 on: October 08, 2009, 10:17:11 AM »
Trojan found while scanning all files with SuperAntispyware. I scan with SAS with MBAM protection turned on and detected this. MBAM give message that something Malicious detected in HijackThis.log. I quarantined and restored the file for VirusTotal analysis but after restore SAS and MBAM detected nothing in this file. I don’t know where the Malicious thing gone away.

See the image of detection by MBAM.

No virus detected by VirusTotal
http://www.virustotal.com/analisis/b0820191d250d2a34c554c2d1a578c2fee05f29df2d6ce6fa7c83bc5480bd3f2-1254987948

I don’t know what is going on inside my computer.

samnetx
« Last Edit: October 08, 2009, 11:47:31 AM by samnetx »
Logged
Pages: 1 [2] 3 4   Go Up
« previous next »