Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.



Windows 7: Eh..

22 Mar 2010   #1

Windows 7 Ultimate x86 7600.16385
 
 
Eh..

I've got a virus... most likely a bot... Microsoft Security Essentials doesn't detect it. It's in "C:\Windows\System32\Avira\Avira.exe", its a hidden folder, and get this.. every time I delete it, empty my recycle bin.. the file is restored. Some shit, eh? Anyway, there's obviously some reg mods involved in this. I just need it to be gone.. I don't care how.. and reformatting is not an option at the moment, because the drive I use for backup has failed. Any pointers? Thanks..

~TA

My System SpecsSystem Spec
.

22 Mar 2010   #2

Windows 7 Ultimate x64, Mint 9
 
 

Run Malware Bytes, and any other AV software until you catch and remove it.

~Lordbob
My System SpecsSystem Spec
22 Mar 2010   #3

Windows 7 Professional 32-bit (6.1, Build 7600)
 
 

Quote   Quote: Originally Posted by TheAnonymity View Post
I've got a virus... most likely a bot... Microsoft Security Essentials doesn't detect it. It's in "C:\Windows\System32\Avira\Avira.exe", its a hidden folder, and get this.. every time I delete it, empty my recycle bin.. the file is restored. Some shit, eh? Anyway, there's obviously some reg mods involved in this. I just need it to be gone.. I don't care how.. and reformatting is not an option at the moment, because the drive I use for backup has failed. Any pointers? Thanks..

~TA
Try Hitman Pro Hitman Pro 3 - SurfRight
Are you able to search for AV products without being re-directed?
My System SpecsSystem Spec
.


22 Mar 2010   #4

Windows 7 & Windows Vista Ultimate
 
 

Hi, TheAnonymity.

Although there is a "look-alike rogue imitating Avira (Malware Diaries Blog Archive Avira look alike) in conducting a search for "C:\Windows\System32\Avira\Avira.exe", there was only one search result -- your post.

Let's see what an MBAM scan shows:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, be sure Quick scan is selected, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, EXCEPT items in System Restore as shown in this sample:
  • Click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be found here on Windows XP: C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt and C:\Users\UserName\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt on Windows Vista and Windows 7.
  • Please post contents of that file in your next reply.
My System SpecsSystem Spec
22 Mar 2010   #5

Windows 7 Ultimate x86 7600.16385
 
 

It seems to be gone. I did a quick scan, but nothing was found. So here are the results from my full scan:
Code:
Malwarebytes' Anti-Malware 1.44
Database version: 3902
Windows 6.1.7600
Internet Explorer 8.0.7600.16385

3/22/2010 8:11:15 PM
mbam-log-2010-03-22 (20-11-15).txt

Scan type: Full Scan (C:\|)
Objects scanned: 101932
Time elapsed: 2 hour(s), 12 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7545i017-hls8-60od-7323-b764203cb058} (Generic.Bot.H) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\Avira\Avira.exe (Generic.Bot.H) -> Delete on reboot.
Thanks for your help guys. Twas a bot after all.
My System SpecsSystem Spec
22 Mar 2010   #6

Windows 7 Ultimate 32 bit
 
 

Glad you found it and got rid of it.
My System SpecsSystem Spec
Reply

 Eh..





Thread Tools



Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 03:29 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33