urgent Trojan.vbagent

prince1630

I Don't know how to remove this Virus .

But Please help me remove this virus .. I have alot of imporant files in my computer please!

I already use Malwarebytes .. When it detects a trojan in a folder .. the whole folder will be deleted.

For example C:/Windows/Program Files/Trojan.VBAgent (QUARANTINED) ..

It delete all Window folder.

Need Help

Find more posts tagged with

Comments

prince1630

And whats is this?

csalgau

As per your example, there is no reason to have a Program Files folder under C:\Windows.

Please provide a scan log or detection name.

Issues with third party products should be addressed by that third party.

We do not normally provide manual removal instructions for threats.

Alesha

I Don't know how to remove this Virus .

But Please help me remove this virus .. I have alot of imporant files in my computer please!

I already use Malwarebytes .. When it detects a trojan in a folder .. the whole folder will be deleted.

For example C:/Windows/Program Files/Trojan.VBAgent (QUARANTINED) ..

It delete all Window folder.

Need Help

If there is a virus send it to sendspace.com and provide a link.

prince1630

It's Win32:VBCrypt-BFB [Trj]

prince1630

Malwarebytes Anti-Malware (Trial) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.07.21.06

Windows 7 x86 NTFS

Internet Explorer 9.0.8112.16421

Prince :: CZECH [administrator]

Protection: Disabled

7/21/2013 8:53:36 AM

MBAM-log-2013-07-21 (08-55-25).txt

Scan type: Full scan (C:\|D:\|)

Scan options disabled: P2P

Objects scanned: 31122

Time elapsed: 1 minute(s), 42 second(s) [aborted]

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 2

HKCR\CLSID\{ae48ed75-5a56-4c5f-bbce-6f1ac3875f66} (PUP.DealPly) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66} (PUP.DealPly) -> No action taken.

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run| (Trojn.VBAgent) -> Data: C:\Windows\820681872.exe -> No action taken.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 17

C:\Windows\820681872.exe (Trojn.VBAgent) -> No action taken.

C:\Program Files\DealPly\DealPlyIE.dll (PUP.DealPly) -> No action taken.

C:\ $Recycle.Bin.exe (Trojn.VBAgent) -> No action taken.

C:\ Avenger.exe (Trojn.VBAgent) -> No action taken.

C:\ Boot.exe (Trojn.VBAgent) -> No action taken.

C:\ CherryDeGames.exe (Trojn.VBAgent) -> No action taken.

C:\ Config.Msi.exe (Trojn.VBAgent) -> No action taken.

C:\ Documents and Settings.exe (Trojn.VBAgent) -> No action taken.

C:\ GarenaDownload.exe (Trojn.VBAgent) -> No action taken.

C:\ NVIDIA.exe (Trojn.VBAgent) -> No action taken.

C:\ PerfLogs.exe (Trojn.VBAgent) -> No action taken.

C:\ Program Files.exe (Trojn.VBAgent) -> No action taken.

C:\ ProgramData.exe (Trojn.VBAgent) -> No action taken.

C:\ Recovery.exe (Trojn.VBAgent) -> No action taken.

C:\ Users.exe (Trojn.VBAgent) -> No action taken.

C:\ Windows.exe (Trojn.VBAgent) -> No action taken.

C:\Kzzvxhikhwc.exe (Trojn.VBAgent) -> No action taken.

(end)

csalgau

I meant a Bitdefender scan log. We have no way of fixing problems or offering support for the mentioned third party product.

If you would kindly look at the provided log fragment, you will notice that all critically looking detections are not related to your operating system.

Since that is not a Bitdefender detection, I cannot actually do much to check your specific case, but I believe I have a quite accurate description for your situation.

The sample has listed various directories on your drive, marked them as hidden, and produced a copy of itself with the same. The sample probably features a folder icon, and given that (as can be seen from the log) the names are prefixed with a space character, these would appear before other files in a sorted directory listing.

Under a default configuration a user would be led to believe she is opening a folder, when in fact she is running an copy of the sample (which in turn opens an explorer window with that folder). The sample has probably reverted these windows settings to defaults, to ensure a user does not notice duplicate folders and the .exe extension on these new "directories".

It should be perfectly safe to allow your security solution to delete these files, but, depending on the corrective actions that may or may not be taken along side deletion by said product, you may have to manually unhide your operating system folders.

Have a nice day!

verdimillious

you got infected even if you use bitdefender? im not infected but im puzzled why bitdefender total security 2013 got 7% in matousec test result...

are they kidding? or got paid by kaspersky? Comodo is on the 1st place and its free... what the F***!!

why bitdefender dont have sandbox?

we rank no.1 in all test except matousec proactive challenge

Pls expain it to me sir why we failed to prevent those basic virus and malwares...

im not discourge, i just want to know

Thanks!!

busterbuddy

you got infected even if you use bitdefender? im not infected but im puzzled why bitdefender total security 2013 got 7% in matousec test result...

are they kidding? or got paid by kaspersky? Comodo is on the 1st place and its free... what the F***!!

why bitdefender dont have sandbox?

we rank no.1 in all test except matousec proactive challenge

Pls expain it to me sir why we failed to prevent those basic virus and malwares...

im not discourge, i just want to know

Thanks!!

FWIW matousec is a 64-bit firewall test -- some criticize it for really being a firewall HIPS test...The version tested was BD IS 2013 v 16.30.0.1843. I agree that this result is extremely disturbing. Particularly so in view of the fact that matousec's test of BD Total Security 2011 32-bit received an Excellent Rating of 97%. Does the

fact that BD IS latest edition stealths all service ports mean that it's failure on matousec's latest "firewall" test should not be a concern?