AntiSpyBoss

[JeanInMontana]

Sorry I didn't read the instructions for posting F/P's before I took action. I have the regular log and the item is still in quarantine.

Malwarebytes' Anti-Malware 1.04

Database version: 378

Scan type: Quick Scan

Objects scanned: 24261

Time elapsed: 4 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-55238811-1876427739-2962232704-1005\Dc25.tmp (Rogue.AntiSpyBoss) -> Quarantined and deleted successfully.

I don't know how it could have got to Recycler much less even on my system.

[Hardhead]

Hi Jean,

1. Click the Start Menu.

2. Click Run.

3. Type in "mbam.exe /developer", without the quotes.

4. Run the same type of scan you did before and save the logfile and post it.

Then Bruce or Marcin can take a better look at that.

[JeanInMontana]

Hi Jean,

1. Click the Start Menu.

2. Click Run.

3. Type in "mbam.exe /developer", without the quotes.

4. Run the same type of scan you did before and save the logfile and post it.

Then Bruce or Marcin can take a better look at that.

It's useless once you have already taken action. Shows nothing... that's why I said I hadn't read the instructions first.

[nosirrah]

Restore it from quarantine , scan again .

[JeanInMontana]

Restore it from quarantine , scan again .

I was waiting to hear that. Will do for you.

[JeanInMontana]

I did this twice, this is most recent. First one had some sort of burp in it. Everything cleared out on it's own after detection and I saved a log. So I scanned again.

Malwarebytes' Anti-Malware 1.04

Database version: 378

Scan type: Quick Scan

Objects scanned: 24243

Time elapsed: 4 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-55238811-1876427739-2962232704-1005\Dc25.tmp (Rogue.AntiSpyBoss) -> No action taken. [HASH=Rogue.AntiSpyBoss, 9e30ab5e3f6b43f69f928e6b4fcfd604]

[nosirrah]

I can fix that from what you gave me but I want to double check the actual file .

If you can, zip and attach it to you next post (or you can VT it yourself )

If its not in the actual recycle bin on your desktop turn on show hidden and system and find it in C:\RECYCLER .

Thanks

[JeanInMontana]

I can't find it Bruce. I restored it, I have done file search and get nothing. I don't know what else to do.

[nosirrah]

Its OK , I think this is a stray part of an installer that is used by both malware and non malware .

I'm removing it .

EDIT TO ADD :

If you ever have issues getting files out of recycler you can use IceSwords file browser to get files out of recycler , windows/dowloaded program files , TIFs and other locations that the windows API does not allow regular access to .

[nosirrah]

I think I have this fixed .

[JeanInMontana]

Scanned with 1.04 today and nothing came up. I haven't dumped recycle so seems fixed.