Author Topic: Help with a Virus  (Read 3173 times)

TheBigBill

  • Guest
Help with a Virus
« on: April 02, 2006, 11:48:33 AM »
Hey guys,

My brother was "playing" on the computer last night, and supposedly we got a couple of viruses. I ran my McAfee scans and removed all of the infected files as per McAfee's instructions. However, I keep getting a mcAfee alert every 20 minutes or so telling me I have the FakeAlert-B trojan in my Windiws/System32 folder.

It won't let me quarantine or delete the file, so I just skipped it and ran a bunch of scans. I ran full McAfee Virus Scan (newest updates), Symantec free scan from online, Windows Dfender Spyware (newest), and Windows Malicious Software removal tool. I did full scans on each and everything came up clean.

However, I still get the FakeAlert-B trojan pop up. Does anyone have any ideas? I appreciate any help with this. Thanks so much.

Bill
« Last Edit: December 31, 1969, 05:00:00 PM by TheBigBill »

Offline NI4NI

  • Addin' Clorox to the gene pool..
  • Forum VIP.
  • ******
  • Posts: 4842
(No subject)
« Reply #1 on: April 02, 2006, 12:00:07 PM »
Turn off System Restore, reboot and turn it back on.  It should be gone.
« Last Edit: December 31, 1969, 05:00:00 PM by NI4NI »

TheBigBill

  • Guest
(No subject)
« Reply #2 on: April 02, 2006, 01:14:14 PM »
Hi,

I tried that. I also turned off systemr estore, booted into safe, ran McAfee and found nothing, rebooted and turned restore back on. Nothing seems to be working.

I have the popup trojan found window telling me the specific file that is infected. C:\WINDOWS\system32\1024\ld90E.tmp - FakeAlert-B trojan

It's a temporary file and it recreates itself in that folder under a different name each time. When I click on the file and run a scan on that particular file, McAfee doesn't recognize it as a virus, but the popup window recognizes it, very weird.

Any other ideas? Thanks again.
« Last Edit: December 31, 1969, 05:00:00 PM by TheBigBill »

Offline Carolina Mike

  • Chief Forum Janitor
  • Forum VIP.
  • ******
  • Posts: 1889
(No subject)
« Reply #3 on: April 02, 2006, 01:41:16 PM »
Go here and I think this is your trojan:  Removal instructions there:

http://www.short-media.com/forum/showthread.php?t=44053

You have I think: SpywareQuake
« Last Edit: December 31, 1969, 05:00:00 PM by Carolina Mike »
"Women do not sunbathe... They are doing a solar enhancement"


I will not answer a PM if I think the question should have been asked on the forum.

TheBigBill

  • Guest
(No subject)
« Reply #4 on: April 02, 2006, 07:34:24 PM »
Thank you guys so much. I thought it might be that worm but I wasn't getting the other symptoms for it. I ran Spy Sweeper and it located the program/process that was reinstalling the virus. And I followed the instructions found on CM's link and it worked perfectly.

Once again guys I really appreciate your assistance. I'd be up a creak a number of times now if it wasn't for the great people on this forum. Cheers!

Bill
« Last Edit: December 31, 1969, 05:00:00 PM by TheBigBill »

Offline utcheerdad

  • Forum Specialist
  • Forum VIP.
  • ******
  • Posts: 340
Re: Help with a Virus
« Reply #5 on: May 01, 2008, 07:06:37 PM »
on this file i'm getting "File Not Found"....???

Roguescanfix.exe