Adwaware.Relavant.A

Sn33R
Sn33R
in Malware talk

hello alll.... im asking for help.. i have a file on my computer called Adaware.Relavant.A i have scanned and scanned it picks up the file and says deleted but it hasnt 2 minuets later it picks it up again i got it from styleXP.com i am reallly stuck thank you very much rob.

Comments

  • alexcrist
    alexcrist ✭

    StyleXP.com contains only infected files. Don't download from there anymore.


    As for the virus...try deleting the theme you downloaded (the installation kit and the theme itself). After that, try to make a full scan of your computer from Safe Mode:


    1) restart your PC, and keep F8 pressed. The Boot Menu will appear


    2) select Safe Mode (it should be one of the last choises in the list)


    3) in Safe Mode, open StartMenu, click on Run and type


    c:/program files/common files/softwin/bitdefender scan server/bdc.exe /files /boot /arc /mail /log=bdcscan.log /fixed /prompt


    and hit enter.


    Now you have to wait while BitDefender makes a full system scan. When a virus is found, it will ask you what to do with the infected file. If, somehow, there will be a legit file found as infected (False positive), just ignore it. If a real virus is found, delete it.


    Post if it worked or not.


    Cris.

  • Sn33R
    Sn33R

    sorry to be a pain but the run commad you posted wouldnt work program files is on D:/ i changed it but still couldnt get it to work

  • Niels
    Niels ✭
    edited April 2007

    Try this to perform a scan in safe mode :


    Go to start,run,at the run dialog box type cmd press enter. %SystemDrive% press enter ,


    %SystemDrive% cd %ProgramFiles%Common FilesSoftwinBitDefender Scan Server press enter.


    Here are the commands what BD must do with the infections found (you must press on enter after you entered a command):


    To disinfect the infected files type the command:


    bdc /files /boot /arc /mail /log=bdcscan.log /fixed /dis


    To quarantine the infected files type the command:


    bdc /files /boot /arc /mail /log=bdcscan.log /fixed /move /moves


    To delete the infected files type the command:


    bdc /files /boot /arc /mail /log=bdcscan.log /fixed /del

  • Sn33R
    Sn33R
    edited April 2007

    i have done as you said but nothin seems to happen.. when i type %systemdrive% nothing happens just goes to the next line then when i type all mthe rest nothin happens just goes to the next line..

  • loony
    loony

    Hi,


    sorry that i distr.


    think that the scann path is "bdc /N /p"


    to scann over all parti.


    greets


    loony

  • Sn33R
    Sn33R
    edited April 2007

    so how do i do it? im really confused but thanks for all your help so far

  • loony
    loony

    Hi Sn33R,


    sorry my language is german and i have only the pathfor german systems


    cd\


    cd Programme\Gemeinsame Dateien\Softwin\Bitdefender Scan Server\


    bdc \N \p


    please enter this in the prompt Means Ausführen


    Grüsse


    loony

  • Sn33R
    Sn33R

    okthank you very much i couldnt get that to work either thanks for your help but im a noob at cmd prompts lol...

  • loony
    loony

    Hi Sn33R,


    no problem ....


    Did bd fund a real virus in this mode ?


    In a path ?


    greets


    loony

  • Sn33R
    Sn33R

    um im not sure when ever i use a cmd prompt nothin happens at all.. when i scan in normal windows it finds a virus deletes it but it is still there?

  • loony
    loony

    Hi Sn33R,


    Please start windows in normal mode.


    Than make an deep scann with bd


    Setting: - Virus


    first action disinfekt


    second delete


    Setting - Spyware


    first action dis


    second delete


    Bericht (Log) with scolling))


    When you want post this here.


    You can edit the log with Wordpad.


    Greets


    loony

  • Niels
    Niels ✭

    Did you pressed after each command on the enter button? You must also type enter after %SystemDrive%. I now see that I forgot that to say.


    Or you can try this put in the installation disc of BitDefender reboot your pc. Now linuxdefender will start before windows starts so you can perform a full scan.


    Regards


    Niels

  • Sn33R
    Sn33R

    i didnt get a cd i bought it via download.. here is a copy of my scan file says it deleted but it is still there..


    //-----------------------------------------------------------------


    //


    // Product BitDefender Internet Security v10


    // Product 10.2


    //


    // Created on: 24/04/2007 15:29:03


    //


    //-----------------------------------------------------------------


    Virus Statistics


    Scan path : C:\


    D:\


    E:\


    F:\


    G:\


    H:\


    I:\


    J:\


    K:\


    Folders : 8353


    Files : 468084


    Memory processes scanned : 10


    Archives : 2184


    Runtime packers : 43218


    Identified viruses : 1


    Infected files : 2


    Memory processes infected : 0


    Suspect files : 0


    Warnings : 0


    Disinfected files : 0


    Deleted files : 3


    Moved files : 0


    I/O errors : 36


    Scan time : 01:15:59


    Scan speed (files/sec) : 102


    Spyware Statistics


    Registry keys scanned : 1749


    Registry keys infected : 1


    Cookies scanned : 32


    Cookies infected : 0


    Spyware files infected : 0


    Spyware threats detected : 1


    Virus definitions : 533840


    Scan plugins : 16


    Archive plugins : 41


    Unpack plugins : 6


    Mail plugins : 6


    System plugins : 5


    Virus scan options


    Detection


    [X] Scan boot sectors


    [X] Memory Processes


    [X] Scan archives


    [X] Scan runtime packers


    [X] Scan email


    File mask


    [ ] Programs


    [X] All files


    [ ] User defined extensions:


    [ ] Exclude extensions: ;


    Action


    Infected objects


    [ ] Ignore


    [X] Disinfect


    [ ] Delete


    [ ] Move to quarantine


    [ ] Prompt user


    Second action


    [ ] Ignore


    [X] Delete


    [ ] Move to quarantine


    [ ] Prompt user


    Virus scan options


    [X] Enable warnings


    [X] Enable heuristics


    [ ] Show all files in log


    [X] Report file: D:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1177424943.log


    Spyware scan options


    [X] Scan for riskware


    [ ] Skip dial and applications from scan


    [X] Registry keys


    [X] Cookies


    Summary:


    <System>=>HKEY_CLASSES_ROOT\MAGNET Detected: magne2t


    <System>=>HKEY_CLASSES_ROOT\MAGNET Deleted


    <System> Archive repacking successfully completed (actions successfully applied)


    D:\Documents and Settings\Sn33R\Desktop\174974.exe.part=>wise0016 Detected: Adware.Relevant.A


    D:\Documents and Settings\Sn33R\Desktop\174974.exe.part=>wise0016 Disinfection failed


    D:\Documents and Settings\Sn33R\Desktop\174974.exe.part=>wise0016 Deleted


    D:\Documents and Settings\Sn33R\Desktop\174974.exe.part Archive repacking has failed (marked actions not taken)


    D:\RECYCLER\S-1-5-21-1202660629-1708537768-839522115-1004\Dd300.part=>wise0016 Detected: Adware.Relevant.A


    D:\RECYCLER\S-1-5-21-1202660629-1708537768-839522115-1004\Dd300.part=>wise0016 Disinfection failed


    D:\RECYCLER\S-1-5-21-1202660629-1708537768-839522115-1004\Dd300.part=>wise0016 Deleted


    D:\RECYCLER\S-1-5-21-1202660629-1708537768-839522115-1004\Dd300.part Archive repacking has failed (marked actions not taken)


    yes i did press enter but nothing happened ill add some photos of each stage later.. and thank you very much..

  • kninejim
    kninejim

    Hey Sn33R


    Two things.


    The file magne2t that shows was detected in your scan summary is probably from limewire, and will probably be replaced each time you crank up limewire (if you have limewire). I have the same thing happen on my kids' computer. Not much you can do about that other than not use limewire.


    Now, for you computer not running Niels' command lines. I had the same problem on my computer, but I found how to make it work. My computer wouldn't let me go to the BitDefencer Scan Server folder all in one step, so I had to get there one step at a time. Try what's below, and see if that works.


    When you are in safe mode go to start,run,


    at the run dialog box type:


    cmd then press enter.


    Then type %SystemDrive% then press enter.


    Type cd %ProgramFiles% then press enter


    Type cd Common Files then press enter


    type cd Softwin then press enter


    type cd BitDefender Scan Server then press enter.


    type bdc.exe. then press enter.


    That should bring up some dialog that says something about BDC/WIN32-Console etc, etc. with a


    list of parameters and then the command line after the parameters list. Below are the


    different commands for disinfecting, quarantining and deleting infected files. I guess


    pick which one you want to do (Quarantine might be the safest way to go. Then you can go


    back into bitdefender in regular mode rather than safe mode and see if you really want to


    delete a file. Never can tell when you might get a false positive.) Type in the command


    line for your choice of what you want to do, then press enter. That should start the scan.


    Go get a beverage of your choice, sit back and wait for the scan to finish, and it should


    bring up a results list. Good luck. :D


    To disinfect the infected files type the command:


    bdc /files /boot /arc /mail /log=bdcscan.log /fixed /dis


    To quarantine the infected files type the command:


    bdc /files /boot /arc /mail /log=bdcscan.log /fixed /move /moves


    To delete the infected files type the command:


    bdc /files /boot /arc /mail /log=bdcscan.log /fixed /del

  • kninejim
    kninejim
    edited April 2007

    One more thing I didn't see before. The virus is also in a place that starts D:RECYCLER\.....which is in system restore. Most antivirus programs that I know of can't get rid of things in system restore, so about the only way to get rid of them is to turn off system restore, which means you lose all your restore points (not the end of the world), then turn system restore back on to start over with new restore points.

  • loony
    loony
    One more thing I didn't see before. The virus is also in a place that starts D:RECYCLER\.....which is in system restore. Most antivirus programs that I know of can't get rid of things in system restore, so about the only way to get rid of them is to turn off system restore, which means you lose all your restore points (not the end of the world), then turn system restore back on to start over with new restore points.


    Hi to both that´s right.


    i forgett to write that you must turn off the restore points.


    Rightklick to workstation on desktop


    Setting


    Restorepoints


    Here the V un taken an apply and ok


    The sektion is not in funktion, you know...


    After your cleaning don´t forget that turn on an make an new restorepoint.


    Download a-squared Free 2.1


    http://www.emsisoft.com/en/software/download/


    Update the software


    Start the System in Savemode with admin


    Start a-squared


    Now make an deep / slow scann


    Funds action take delete


    If you want you can post the log


    Until this point good work ;)


    Wish you all the best


    loony

  • Niels
    Niels ✭
    edited April 2007

    All magne3t files are part of p2p software and they will always be recreated after being delete by BitDefender. Here some information about it:


    http://www.bitdefender.com/VIRUS-1000093-en--magne3t.html They are harmless.


    To disable system restore do this : go to start,press with your right mousebutton on my computer choose properties,system restore,place a check disable system restore on all stations confirm by pressing on apply and ok. Do not forget to uncheck it again and confirm by pressing on apply and ok. Otherwise windows doesn't made new restore points. Then you must be able to remove the infections found in recycler.


    Regards


    Niels

All Time Leaders

Categories

Defenders of the month