Cheat Engine

the the the · Posted: Fri Feb 19, 2010 10:27 pm Post subject: av.exe virus

I have a virus Evil or Very Mad

It is called av.exe and I have googled it plenty of times, I'm no fool.
I cannot install anything, my current Trend Micro antivirus software FINDS NOTHING.

And stuff I copypastad from another site I posted this:
There is NOTHING in the registry editor that has to do with the antispyware and there is NO AV.EXE (which constantly pops up) IN MY HARDDRIVE (I used search). I have shown hiddenfiles. There is NOTHING in my program files that has antispyware.

Help, anyone?

Zarr · Posted: Fri Feb 19, 2010 10:38 pm Post subject:

Try removing the file with HijackThis

xiGh0stx · Posted: Fri Feb 19, 2010 10:39 pm Post subject:

Yeah im gonna go with that too.. Sorry but i dont think theres much you can do if you screwed windows up =/. IF it is resent enough, you can do a system restore do maybe a day before all this started happening. Try it =]

the the the · Posted: Sat Feb 20, 2010 8:15 pm Post subject:

This happens when I try to do a system restore.

(\/)_(;,,;)_(\/) · Posted: Sat Feb 20, 2010 8:23 pm Post subject:

the the the · Posted: Sat Feb 20, 2010 8:24 pm Post subject:

Notepad · Posted: Sun Feb 21, 2010 4:22 am Post subject:

I suggest you make a UBCD4Win CD and then boot with it then run some of the AntiSpyware/AntiVirus/AntiMalware etc programs and scan the infected drive.

This is very useful as virus' cannot hide (Rootkits will also be detected).

Hero · Posted: Sun Feb 21, 2010 12:28 pm Post subject:

If you can boot safemode with networking, you shouldnt have an issue installing/downloading.

capuchino · Posted: Sat Mar 27, 2010 1:39 am Post subject:

i had that nasty little boy to but my search also didnt find anything but its inside c:/[or whatever this is]documents and settings/yournamehere/[now is there the part u must turn on hidden folders its in extra then folderoptions then turn on hidden folders show or something like that then there is an folder]Application Data/av.exe and then u must kill that bitch then remove it and its done but my account on xp was ruined

bfsdbsdfbdsfb · Posted: Sat Mar 27, 2010 6:16 am Post subject:

masterzero · Posted: Sat Mar 27, 2010 1:52 pm Post subject:

http://www.virusremovalguru.com/?p=5548

Fap2Admin · Posted: Sun Mar 28, 2010 4:34 am Post subject:

capuchino · Posted: Sun Mar 28, 2010 8:49 am Post subject:

Burningmace · Posted: Sun Mar 28, 2010 9:38 am Post subject:

Dump the AV.exe file onto VirusTotal (it's a website, in case you don't know it) and see what it throws up. Paste the link to the analysis here, and I'll see if I can come up with some manual disinfection steps.

In the meantime, get Process Explorer from sysinternals and use it to kill the av.exe process. If it restarts, it'll show the process that started it. That's the process that's performing the keep alive. However, some malware injects code into existing and legitimate processes, so you might be screwed on that front.

Safe mode might not be an option, since it's relatively easy to make malware startup keys persist in safe mode, or just to disable safe mode entirely by screwing up (or deleting) the safeboot key in the registry.

The only guaranteed solution is a complete wipe and re-install. I very much doubt we're dealing with anything like an MBR resident virus or a BIOS infection.

Karakawe · Posted: Sun Mar 28, 2010 2:56 pm Post subject: