Smart Antivirus 2009

I'm not having any issues with my computer, it's a little slow IMO but other than that it works normally. 9/15/2008, Smart antivirus 2009 was installed and I noticed almost immediately and did everything I could do get rid of it. Recently from reading forums I've run Mbam and spybot scanner and fixed some registry errors, I am currently running Kaspersky online scanner which is 50% done and no detections. McAfee scan produces a potential threat every time I run it, when I try and remove it, mcafee says "Cannot be fully removed". It is under the file path...

C:\Users\B-Miller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1USXL1S7\sa2009.exe

I've gone there manually and tried to delete it and I can't.

What should I do?

(Windows Vista 32bit)

Edited by Aorp, 24 February 2009 - 04:33 PM.

I have delt with this many times and i have found a tool (hitmanpro3) you can download it for free from www.hitmanpro.com and it is good for i think 2 weeks then u must pay for it, even then i think its like $10 and i belive it is a 1 time fee. it is not a replacement for antivirus or antispyware but if you are infected it does a good job getting rid of everything ive seen so far (should note every spyware ive seen so far). let me know if it works (or if not)

oh i should note i have not tryed it on vista before.

After the Kaspersky scan is finished run another Quick Scan with Malwarebytes and post that log.

MBAM Log

Malwarebytes' Anti-Malware 1.34
Database version: 1798
Windows 6.0.6001 Service Pack 1

2/24/2009 7:38:19 PM
mbam-log-2009-02-24 (19-38-19).txt

Scan type: Quick Scan
Objects scanned: 59789
Time elapsed: 5 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Kaspersky also had no detections.

How's your computer running now?

It's running like normal, sa2009 was running at startup and I disabled that awhile back and that stopped popups I was getting. After that I ran the mbam tests and the other ones and got rid of most of it. I suppose all I'm asking is if there is a way to get this .exe file off my computer when McAfee can't remove it and right-click > delete can't remove it.


C:\Users\B-Miller\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1USXL1S7\sa2009.exe

Open Malwarebytes, click the More Tools tab and then click "Run Tool" under where is says FileASSASSIN. Navigate to and select the file you want to delete. It might ask for a reboot.

(Thx for your help so far btw)


"sa2009[1] You don't have permission to open this file

Contact the file owner or an administrator to obtain permission"


Note that I followed your instructions and right- click> Select(not open) and this message appears.

I am the administrator

Make sure that when you open Malwarebytes you right-click and select "Run as Admin".

/facepalm

Ok so I did and it gives me the same message.

Have you tried deleting the file in Safe Mode?

Trying safe mode now.

Yes! that worked

Thx alot for your help, probably should have tried safe mode first.

Smart AntiVirus 2009 still shows up in my startup programs when I check with Norton Utilities though, I'm not sure what that means

Edited by Aorp, 24 February 2009 - 09:50 PM.

You should be able to find and delete that startup entry with AutoRuns.

You should be able to find and delete that startup entry with AutoRuns.

That worked, way to be awesome Budapest.