Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Recurring Trojan detected by Kaspersky that won't go away


  • Please log in to reply
1 reply to this topic

#1 ann35

ann35

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:02:40 AM

Posted 26 February 2010 - 10:56 PM

Hello,

I was hoping to get some help with a Trojan that my Kapersky Internet Security keeps detecting but doesn't seem to be deleting. It started about a week ago. I was on a seemingly harmless website I have visited before when all of a sudden i get a message from Kaspersky that it has detected a Trojan called Trojan.Win32.Fraudpack.amau in C:\Documents and Settings\Local Settings\TEMP\7.682492419092743E8.EXE. Kaspersky seems to have quarantined it the day it detected it. But the next day it pops up again multiple times, along with the following:

Trojan.Win32.FraudPack.ambs in C:\Documents and Settings\Local Settings\TEMP\2.0650159810297944E7.EXE
Trojan.Win32.FraudPack.ambs in C:\Documents and Settings\Local Settings\Application Data\av.exe
Trojan.Win32.FraudPack.ambs in C:\Documents and Settings\Local Settings\Application Data\MSASCui.exe
Trojan.Win32.FraudPack.amau in C:\Documents and Settings\Local Settings\Application Data\mtg.exe

Kaspersky shows that it has deleted those mentioned above. It quarantined only once (that first day) but not deleted the following one:
Trojan.Win32.Fraudpack.amau in C:\Documents and Settings\Local Settings\TEMP\7.682492419092743E8.EXE

So now every time I turn on my laptop or just have it on (even if it isnt connected to the internet) , the same Trojan - (Trojan.Win32.Fraudpack.amau in C:\Documents and Settings\Local Settings\TEMP\7.682492419092743E8.EXE) appears again as a detected threat multiple times. I ran Malwarebytes' Anti-Malware this afternoon and it quarantined the following:

Trojan. Downloader - C:\WINDOWS\system32\braviax.exe

I ran Malwarebytes again and it showed no detected threats but I still have the problem with the Trojan.Win32.Fraudpack.amau reappearing on Kaspersky.

I would greatly appreciate any help I could get on getting rid of this thing and whatever else is lurking on my laptop.

Thanks,
Ann

BC AdBot (Login to Remove)

 


#2 Casey_boy

Casey_boy

    Bleeping physicist


  • Malware Response Team
  • 7,765 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:UK
  • Local time:07:40 AM

Posted 03 March 2010 - 08:27 AM

Hi,

Sorry for the delay in responding to your post.

With the information you have provided I believe you will need help from the malware removal team. I would like you to start a new thread HERE and include a link to this thread. Please make sure that you read the information about getting started before you start your thread.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient. Help is on the way!

Casey

If I have been helping you and I do not reply within 48hours, feel free to send me a PM.


* My Website * Am I Infected? * Malware Removal Help * If you'd like to say thanks *





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users