IE & Chrome: "__.exe contained a virus and was deleted." FALSE REPORT

This is a sign of "Zero Access" ... a Rootkit.

Using a known "clean" computer:

STEP 1: Download and create a bootable Kaspersky Rescue Disk CD
1.You can download Kaspersky Rescue Disk utility from link below:
KASPERSKY RESCUE DISK DOWNLOAD LINK (This link will automatically download Kaspersky Rescue Disk (kav_rescue_10.iso) on your computer.)
2.To create the bootable rescue disk, we will need to use the ImgBurn program. You can download ImgBurn from the below link, then install this program.
IMGBURN DOWNLOAD LINK (This link will open a new page from where you can download the ImgBurn program)
3.Insert your blank DVD or CD in your burner, then start ImgBurn and click on the Write image file to disc button.
4.Under Source click on the Browse for file button, then navigate to the location where you previously saved the Kaspersky Rescue Disk utility (kav_rescue_10.iso), then click on the Write button.
ImgBurn will now begin writing your bootable Kaspersky Rescue Disk.

STEP 2: Start your computer using the Kaspersky Rescue Disk
1.Once you’ve got the Kasperky Rescue Disk in hand, insert it into the infected computer, and turn off and then turn it on again.
2.As soon as you power it on, you will see a screen that tells you to press any key to enter the menu, so please tap any key to boot your machine from the Kaspersky Rescue Disk
3.In the next screen, you will need to chose a language, then you click on Kaspersky Rescue Disk. Graphic Mode and press ENTER, to start the Kaspersky Rescue Disk.

STEP 3: Scan your system with Kaspersky Rescue Disk
1.Within a few short seconds you should see the full working environment, with the Kaspersky Rescue Disk screen front and center.
2.Switch tabs over to the My Update Center, and then click the Start update button to load the latest anti-virus definitions. Please be patience while this process its completed.
3.Switch back over to the Objects Scan tab, select the drives you want to scan, and then click the Start Objects Scan button.
4.When Kaspersky Antivirus will detect the “file contained a virus and was deleted” virus, you’ll be prompted to select an action. When this happens, please select Quarantine or Delete to remove this infection from your computer.
5.When the antivirus scan has completed, you can restart back into Windows regular mode, by clicking on the Kaspersky Start button (lower left corner), and selecting Restart.
Once your computer will start in Windows regular more, download Malwarebytes Anti-Malware and HitmanPro (select the 'trial' version), and scan your computer for any left over infections.


Please post all .txt logs :)

Since I don't advocate trying to clean up a Rootkit, simply because you can never be sure the computer will ever be stable again; I would advise you to do a wipe and clean re-install.

TBolt

I'd disagree on the wipe . Leave wiping the PC for the last resort .

I don't and you cannot guarantee that this person's computer will ever be stable!

Look at the odds ... it's extremly old and possibly won't be able to handle all apps that we throw at it to try to 'fix' it.

Its worth a try . Fixing and reinstalling windows and the apps will take about the same time on a laptop with 512MB

TBolt,

As Jacee mentioned, the issue is a sign of a ZeroAccess variant.

The easiest route for this is to run the following diagnostic and removal tool:

Download the Farbar Recovery Scan Tool
Select the version that applies to your system.


Save to the Desktop.

• Double-click the downloaded file to run it.
• When the tool opens click Yes to disclaimer.
• Press the Scan button.
• FRST makes a log (FRST.txt) in the same directory from which the tool is run (Desktop).

Please provide the FRST.txt in your reply.


The first time the tool is run, it also makes another log: Addition.txt
Also post the Addition.txt in your reply.



Next, download Farbar Service Scanner

Save to the Desktop

• Make sure the following options are checked:
  
  • Internet Services
  • Windows Firewall
  • System Restore
  • Security Center
  • Windows Update
  • Windows Defender
• Press: Scan
• FSS creates a log, FSS.txt, on the Desktop.

Please provide the FSS.txt in your reply.

Thanks!