Infected Again! What next?

[bluewizard]

I was surfing the Net again, and opened a page that was one of the pages that starts downloading, or allegedly so, Anti-virus software, and prevents you from closing the window to stop the download. I did lock the Internet connection right away, then kill my browser. I thought I had prevented it, but I'm pretty sure the Malware is on my computer.

There is a file AV1.tmp at about 55Mb (C:\Windows\temp\AV1.tmp), there were actually several copies of it, I deleted some of them but one stubbornly remains. Of course, I can delete it because it is a locked file. I tried using Malwarebytes FileASSASSIN, but still couldn't get rid of the file. It has now renamed itself, and has grown in size.

I went into REGEDIT and deleted all references to AV1.tmp, hoping it wouldn't be locked next time I started the computer, then I could delete it. But, that is when it appeared again under the name AV2.tmp. I tried FileASSASSIN again, and now the file has renamed to AV3.tmp.

I ran Malwarebytes, a complete scan of all my drives and partitions, and found nothing.

Can any one point me in the right direction???

Thanks,

Steve

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post DDS.txt directly into your reply.

[bluewizard]

I ran a MalwareBytes Anti-Malware and it found nothing. I did a complete scan with ZoneAlarm and it found nothing.

I think the file I was concerned about might be related to the new version of ZoneAlarm. ZoneAlarm uses a version of Kepersky Anti-Virus, and this file might be related to that.

I will run the suggested programs, and if I find anything, I will report back. But for now, I'm going to say you can ignore this thread.

One thing I have noticed is that the file AV?.tmp, goes away when I close Windows. I rebooted to Safe Mode with Command Prompt, and when I go to the specified directory, it doesn't find and file.

So, for now, I'm going to assume this is a temp file being kept by my Anti-Virus/Firewall program.

Thanks.

Steve

[screen317]

Yes the AV*.tmp appear to be related to your security software.

I'll leave this thread open for a few days if you have further questions.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!