iloveyou virus gone?

[win7sony]

Yesterday I accidentally clicked on a link that led to the code of an iloveyou virus. I got a pop up from my avast internet security saying malware blocked, unfortunately though, I didn't have time to look at weather the virus was blocked properly. I had a look in the chest and it wasn't there. When i looked at the real time shield traffic it was on there as an infected file though. AM I INFECTED?! PLEASE HELP!



 

[SafeSurf]

Welcome to the forum win7sony .  First I need to know the following:

1.   What is your OS, 32 or 64-bit, RAM?
2.   What version of Avast did you install?  5.0.594? 
3.   Are the Avast definitions (updates) current?
4.   When was the last time you did any kind of scan in Avast, and if so what kind of scan was it?

[win7sony]

Welcome to the forum win7sony .  First I need to know the following:

1.   What is your OS, 32 or 64-bit, RAM?
2.   What version of Avast did you install?  5.0.594? 
3.   Are the Avast definitions (updates) current?
4.   When was the last time you did any kind of scan in Avast, and if so what kind of scan was it?

I run windows 7 professional 64-bit and I have 3gb of ram with 2.73gb usable
I have avast internet security 5.0.594 and my virus definitions are up to date
My latest scan was a right click scan of an eicar test file (just to check avast! was working, I have just started a full scan)

[SafeSurf]

I was going to suggest an Avast Full Scan.  Wait for the results.  Have you changed any of the Avast default settings?  Default should sent malware to the Virus Chest.

[win7sony]

I was going to suggest an Avast Full Scan.  Wait for the results.  Have you changed any of the Avast default settings?  Default should sent malware to the Virus Chest.

Yes, malware by default is sent to the chest. I will give you the results when the full scan is complete.

[SafeSurf]

OK.  I know the scan will take a while.  After that is done, there is another tool since you have 64-bit machine, you will be unable to run a boot-time scan, so you can download Malwarebytes’ Anti-Malware (MBAM) to check for malware.  It works differently from Avast and is good to have as a back up:

·   Download free MBAM http://www.malwarebytes.org/ for an on-demand scanner.
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform FULL Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine if anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

Let me know if you have any questions and I will analyze the reports later.  Thank you.

[win7sony]

OK.  I know the scan will take a while.  After that is done, there is another tool since you have 64-bit machine, you will be unable to run a boot-time scan, so you can download Malwarebytes’ Anti-Malware (MBAM) to check for malware.  It works differently from Avast and is good to have as a back up:

·   Download free MBAM http://www.malwarebytes.org/ for an on-demand scanner.
·   Double Click mbam-setup.exe to install the application.
·   After install, click update so you have latest database before scanning.
·   Under Settings:
o   General: Automatically Save File After Scan Completes is checked off
o   Scanner Settings:  Check all boxes
o   Updater: Download and install update if available is checked off
·   Once the program has loaded, select "Perform FULL Scan", then click Scan.
·   The scan may take some time to finish, so please be patient.
·   When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
·   Click the “remove selected” button to quarantine if anything found.  You will find the infection details under the Quarantine tab.
·   The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
·   Copy & Paste the entire report in your next reply.

Let me know if you have any questions and I will analyze the reports later.  Thank you.

sooooooo sorry Just  after the infection i ran a scan with mbam!

[SafeSurf]

No problem...did it quarantine anything?

[win7sony]

No problem...did it quarantine anything?

No, just an eicar

[CraigB]

I think that with avast telling you that it blocked this and malwarebytes coming up clean you would be pretty safe, unless you start seeing some unusual activity happening on your cpu. Superantispyware is also good for a third opinion but look's like avast did it's job and did it well 

[SafeSurf]

win7sony,

Did the Avast Full scan come out clean?

[win7sony]

win7sony,

Did the Avast Full scan come out clean?

Yes, the only thing it got was an eicar

[SafeSurf]

It sounds like you are OK, but if you want to run a different test to make sure, try free Dr. Web CureIt http://www.freedrweb.com/cureit/?lng=en.  After you download it to your desktop, run the scan, which will take a while.  Review the scan, which will be quite long for any errors.  After running the scan, you can safely delete Dr. Web CureIt from your desktop and put it in the recycle bin; if you need it another time you will need to download it again.

To avoid the iloveyou worm in the future, I would suggest that you use No Script in your browser, do not open any email or attachments from people you do not know, and browse carefully.

What browser do you use?  If you use FF, take a look at my signature for some recommended add-on's for extra protection.

I also suggest if you don't already have a good cleaner for your system like CCleaner http://www.piriform.com/ccleaner/builds.  It removes unused files (cache, temporary Internet files, etc.) from your system - allowing Windows to run faster and freeing up valuable hard disk space.  It also cleans traces of your online activities such as your Internet history.  Additionally it contains a fully featured registry cleaner.  Remember when installing to uncheck the Yahoo toolbar. 

Let me know if you have any questions.  Thank you.