[PupsterDO]

I don't know if anyone can help me, but I opened up IE yesterday and Avast! found a virus (in my recovery partition, no less) in BAE.dll. It was listed as Win32:Adware-gen [Adw]. I first put it in the virus vault but then decided to delete it. Did another scan, and it was back. I deleted my temporary internet files of both IE and Firefox and ran a third scan over night and nothing was detected.

Does this seem strange? Is the adware still there even though it wasn't detected after the third scan? Would deleting my temporary internet files (which I hadn't done in a while) really get rid of this problem? Why was this adware showing up in my D:\\ drive (recovery partition)?

Should I be concerned?

JP, I thought maybe you could help...

[mod]Moved to Anything Goes[/mod]

 

[jpark]

I use AdAware from lavasoft to get rid of spyware.

There's a free version for non-commercial use at http://www.lavasoft.com/products/ad_aware_free.php.

 

[PupsterDO]

I tried Adaware last night and it only found 32 tracking cookies. I don't know what to do...

 

[PupsterDO]

Does this seem strange? Is the adware still there even though it wasn't detected after the third scan? Would deleting my temporary internet files (which I hadn't done in a while) really get rid of this problem? Why was this adware showing up in my D:\\ drive (recovery partition)?

 

[jpark]

http://forums.comodo.com/virusmalware_r ... l;msg73367

 

[Dasha]

I hate those pesky viruses!! Hope u get the problem resolved!!

 

[PupsterDO]

Thanks JP. I will give a whole list of things a shot when I get home tonight. Should I say that if scans don't show anything, that my harddrive is clean? Also do viruses/malware live in temporary internet files? Cuz when I deleted them, the next scan was clean.

I still don't understand why it was showing up in the recovery partition of my harddrive... any thoughts?

Can stuff like this get transferred over to my BlackBerry or smartphone that has internet? Just curious if I should be worried about that as well

 

[jpark]

Viruses and malware can do whatever the "programmer" (for the lack of a less respectful term) tells them to do.

They can't infect mobile devices unless the code can also run on that mobile device's OS.

 

[PupsterDO]

But does it make any sense that this adware was "living" in my temporary internet files or is it just a plain coincidence that it didn't show up on that third scan after I cleaned my cache?

If I scan tonight and everything comes back without viruses, can I consider it gone?

 

[jpark]

Yes, it could be in the same folder as temporary internet files, if that's where the virus puts itself.

If the scan shows that it's gone after all drives and memory are scanned, it should be gone. Viruses are only able to hide if the virus scanner can't detect a virus signature, and since yours detected that already, the virus should be gone.

This is what has always made me suspicious of viruses. One conspiracy theory is that anti-virus software vendors write half of the virsuses themselves. Is there a better way to sell A/V software, especially when the free versions can't remove some of the viruses?

Just sayin'.

 

[PupsterDO]

But is what I had a virus? Or is it just Adware/Malware?

 

[PupsterDO]

If the scan shows that it's gone after all drives and memory are scanned, it should be gone.

How do I scan memory? I only know how to scan my harddisks with Avast!...

 

[jpark]

Most A/V programs scan memory automagically as a part of any scan.

 

[PupsterDO]

Most A/V programs scan memory automagically as a part of any scan.

From everything I've said, is what I had a virus? That's what Avast! told me. But isn't it just Adware/Malware?

 

[jpark]

If it affects a DLL, it's technically a virus.

It doesn't matter what it's called. If it can run, or if it can affect anything else that runs, it's a virus.

 

[Squishy]

I moved the topic because it doesn't have anything to do with the Triplets (and thus doesn't really belong in "The Garage").

If you are running a recent edition of Windows, run a System Restore to a week before you first saw the virus warning. After that, boot into safe mode and run a full anti-virus scan.

 

[PupsterDO]

I moved the topic because it doesn't have anything to do with the Triplets (and thus doesn't really belong in "The Garage").

If you are running a recent edition of Windows, run a System Restore to a week before you first saw the virus warning. After that, boot into safe mode and run a full anti-virus scan.

I thought system restore was garbage... JP, is what Squishy's saying correct?

 

[jpark]

Yes on both counts.

System Restore actually works pretty well, from the two times I've used it. You'll lose anything you've done since the date of the restore, though.

 

[PupsterDO]

Yes on both counts.

System Restore actually works pretty well, from the two times I've used it. You'll lose anything you've done since the date of the restore, though.

Will I lose programs? I'm running Vista Home Premium BTW...

 

[jpark]

That's fine. You won't lose anything that you didn't already have on the date that you're going to roll back to.

But, just in case, do a backup of your vital stuff. I use a second hard drive (I have an external SATA port) and a USB flash key for vital stuff.