win32:Bredolab-be keeps trying to infiltrate every five minutes

[mrmalkovich]

hey there.. running winXP. my antivirus keeps picking up this virus every five minutes in my temp file. supposedly i haven't been infected yet, but this is obviously not a good thing. can anyone tell me why this is happening?

[GT500]

There is a possibility that this is a false positive on the part of your anti-virus (CA?). Please read the article from Microsoft at this link, and let me know if your computer is experiencing any of the other symptoms that they mention, or if there are any files like the ones they mention.

[mrmalkovich]

There is a possibility that this is a false positive on the part of your anti-virus (CA?). Please read the article from Microsoft at this link, and let me know if your computer is experiencing any of the other symptoms that they mention, or if there are any files like the ones they mention.

nothing in the descriptions of Bredolab in the link you supplied sound familiar to my problem. here is the path Avast gives me for the supposed virus.

C:\WINDOWS\TEMP\fvnp.tmp\svchost.exe

[GT500]

Well, it may very well be right. What utilities have you used to scan with so far?

[mrmalkovich]

Well, it may very well be right. What utilities have you used to scan with so far?

i plan to run Avast's re-boot scan overnight, as well as MalwareBytes. do you have any other suggestions? does this still sound like a false positive?

[GT500]

do you have any other suggestions?

Well, you can try things like Spybot Search & Destroy (just don't let it install TeaTimer) and SUPERAntiSpyware as backups, but automated tools like that don't always catch everything.

does this still sound like a false positive?

No, it does not.

[mrmalkovich]

Well, you can try things like Spybot Search & Destroy (just don't let it install TeaTimer) and SUPERAntiSpyware as backups, but automated tools like that don't always catch everything.

No, it does not.

why does it not sound like a false positive any more?

will MalwareBytes pick this one up?

does it seem as if it's already in my computer? or is it trying to get in repeatedly? and if it's the latter, what avenues is it most likely to be taking to get in? i've never seen a trojan throw itself at my computer over and over again like this.

thank you so much for your help with this.

[Firefox]

its not a false positive because the file C:\WINDOWS\TEMP\fvnp.tmp\svchost.exe is trying to run from a temp folder. Especially the file svchost.exe. Your antivirus keeps warning you probably cause the file is still located there. Have you tried to quarantine it?

I would run CCleaner and delete all files in the temp folders.

Then install and update Malwarebytes and it should catch any other infections that may be left behind.

That should clean it up.

[mrmalkovich]

its not a false positive because the file C:\WINDOWS\TEMP\fvnp.tmp\svchost.exe is trying to run from a temp folder. Especially the file svchost.exe. Your antivirus keeps warning you probably cause the file is still located there. Have you tried to quarantine it?

I would run CCleaner and delete all files in the temp folders.

Then install and update Malwarebytes and it should catch any other infections that may be left behind.

That should clean it up.

i choose 'move to chest' every time it pops up.

as of the last ten minutes, clicking on google links sends me to a bunch of crap sites i didn't choose, so i guess it's official.

will ccleaner delete all files in the temp folder? or do i have to do that manually?

[noknojon]

Hi mrmalkovich -

Yes , most to Firefoxes answer - You can also use Accessories > System tools > Disc Cleanup - An inbuilt tool to do a similar thing -

If you have not found it yet this may be a case for a Full Scan - (will take about 1 hour) - A quick scan will take about 5-7 mins depending on your system -

Just did a full scan on my XP SP3 - It took about 1 hour 14 mins , while I was playing cards at the same time -

Please follow Firefoxes' instructions above first -

Thank you -

[mrmalkovich]

Hi mrmalkovich -

Yes , most to Firefoxes answer - You can also use Accessories > System tools > Disc Cleanup - An inbuilt tool to do a similar thing -

If you have not found it yet this may be a case for a Full Scan - (will take about 1 hour) - A quick scan will take about 5-7 mins depending on your system -

Just did a full scan on my XP SP3 - It took 1 hour 14 mins -

Please follow Fifefoxes' instructions above first -

Thank you -

hey noknojon! are you talking about a full scan with ccleaner? or malwarebytes? or both?

[noknojon]

Sorry if I did not put it fully -

MBAM Full scan - C Cleaner takes 5- 20 seconds - (On average depending if you ever remove temp files)

As stated above Please follow Firefoxes' ideas first -

P.S. Please just hit Fast Reply button unless you are refering to a specific posting as it clogs the page -

Thanks -

[Firefox]

Run CCleaner first to delete temporary files first, this will help reduce the time it will take to do if full scan if its a full scan you want to run.

Either if you run a quick scan or a full scan.... make sure you update MBAM first.

[kpgumbo]

@ noknojon As far as I am aware there is never a need to do a full scan with mbam as "a quick scan is a more powerful tool" I might be wrong but I'm sure someone told me that in this forum before !

[cush]

I am having the exact same issue. Deleteing the temp files has not helped. They just coming back. Quick and full scans have not resolved the issue. Avast keeps finding new copies every 5 minutes.

[GT500]

I am having the exact same issue. Deleteing the temp files has not helped. They just coming back. Quick and full scans have not resolved the issue. Avast keeps finding new copies every 5 minutes.

Please follow these instructions (skipping any steps you are unable to complete) for posting in our Malware Removal - HijackThis Logs forum. If you cannot follow any of those steps, then please create a new topic in that forum explaining what happened when you tried to run each of the tools in the instructions, and the expert who helps you will be able to suggest steps to take to get the tools working.

Alternately, you may contact our helpdesk and someone can work through this issue with you via e-mail.

[noknojon]

@ noknojon As far as I am aware there is never a need to do a full scan with mbam as "a quick scan is a more powerful tool" I might be wrong but I'm sure someone told me that in this forum before !

That is true in about 90-95% of problems - I have had only one recently that I needed a Full scan as it was deeper than usual -

I got it at about the 35-40 min mark (75% of the full scan) , but I let it finish to make sure -

That is one of the reasons that a Full scan option is provided - If you know something is there then do a full scan, to ensure it is removed not just found -

Daily (updated) quick scans are enough to alert you of, and remove, most malware related problems -

As stated by Firefox 'you also need to first remove temporary files' - CCleaner or Disk Cleaner in system tools -

[Roadkil]

Run CCleaner to empty all temp files after closing all your browsers and also run the Registry Checker to clean all unused registry entries and then run a quick scan.

[AdvancedSetup]

These are all signs of infection. If MBAM is unable to fully remove this infection on it's own for you then please follow the directions below and someone will assist you as soon as they can. The site is quite busy though and it may take a few days so please try to be patient.

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someon has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org