Win7 Antivirus 2012 Just Won't Go Away!

Man, this is frustrating. I was reinstalling Win7 Professional and somehow Win7 Antivirus 2012 found me. I've been going crazy trying to get rid of it. I actually deleted the partitions on my boot drive and my data drive and reformatted.

I'm seeing, on the file icons for security apps such as BitDefender and Malwarebytes, a small shield icon that attaches itself to the application icon. I'm assuming that that's Win7 Antivirus thumbing its nose at me. Am I right?

I've pmed to Christian, and tried to send autoruns and bdsyslog files. I had to put them on Sendspace because they wouldn't upload to the PM. I hope you get them!

Please let me know what you think, and what I can do. I'd appreciate any assistance her.

Thanks!

Find more posts tagged with

Comments

GSchaumburg

I note -- after reading the rules (shoulda done that first!) -- that I wasn't supposed to PM till instructed to do so.

Please let me know how to proceed and I'll comply.

Thanks

rootkit

Hello

I have received the logs, the guys from the lab are currently analyzing them.

Until I receive the results, please download this utility:

http://goo.gl/ywhA

Save it on your desktop. Double click on it to run it. A command prompt window will appear on the screen. This utility will kill the rogue / Fake AV application from your machine, but the file will not be deleted.

After the process is finished, a log will be opened in Notepad or your default text editor. Save it and send me a PM with it. I will get back to you after the analysis.

Thank you. Take care.

GSchaumburg

I did as you directed -- downloaded and ran RKill. The log was PMed to you.

After running RKill, I am still seeing a small shield appear in the lower right-hand corner of program icons, which makes me worry that the virus is somehow still resident.

Thank you very much for your assistance. I await further analysis.

rootkit

Welcome back

Let's try something else.

Download this utility:

http://technet.microsoft.com/en-us/sysinternals/bb896645

Unzip it and run Procmon.exe (with right click on it and choose Run as administrator).

Let it run for 5 minutes. In this time, please try to open that small shield that you mentioned so it can run in the memory.

After 5 minutes go to File->Save. Make sure that you check all Events and save the file Logfile.PML.

Upload that file on www.mediafire.com or www.sendspace.com and send me a PM with the download link.

Thank you.

GSchaumburg

I will, and happily, but I'm not sure what you mean by "run small".

Gary

rootkit

I was referring to the shield that you mentioned in you last post.

I have corrected the instructions. Thank you.

GSchaumburg

Ah, geez -- I get you. I'm probably going to have to do it again! Sorry -- didn't understand.

The ProcMon file takes a while to load to Sendspace, but I'll try to get another run to you posthaste.

Thanks!

Gary

rootkit

Hi Gary.

Could you please send me a screenshot of that Fake Antivirus program via PM with the new log?

I want to see how the program looks like.

Thank you.

rootkit

Please pack these file(s) in archive with the password infected and send me a PM with it.

C:\Windows\downloader.exe

C:\Windows\System32\wbem\downloader.exe

C:\Windows\System32\downloader.exe

C:\Windows\system\downloader.exe

These could be hidden, use this settings to revel them:

http://www.bleepingcomputer.com/tutorials/...s-in-windows-7/

If the file is too big to attach it, upload it on

http://www.sendspace.com

http://www.mediafire.com

and send me a PM with the download link.

We will analyze the information you sent and then reply with a possible solution in the shortest time.

Have a nice day.

GSchaumburg

I did not find the downloader.exe file in any of those locations. I'm familiar with displaying hidden files, and usually have it turned on. When I went into Control Panel, I found display hidden files turned off, and it took me a couple of attempts (and re-running rkill) to get it to stay on. But I do not find any of those files.

This is making me very nervous.

Gary

rootkit

Hi Gary

I will analyze the second log and I will get back to you with an answer.

Thank you.

rootkit

Hello Gary

I have analyzed the other log and it looks clean.

Since those files are not in the system right know, your machine is protected.

Those messages and the icons from files are generate by UAC (User Account Control) from Windows.

Please check this website for further references:

http://msdn.microsoft.com/en-us/library/wi...p/aa511445.aspx

If you need any further assistance on this issue, please feel free to let us know.

Take care.

GSchaumburg

So I was snookered by Windows itself! I've never seen that UAC symbol before . . .

Hey, Christian, thanks so very much for your assistance, I really appreciate it!

Gary

rootkit

Welcome back Gary

Thank you for your feedback.

Since this case was resolved, I declare this topic closed.

If you need any information, I am here for you.

Take care.