[go4saket]

Hi Guys!

I am using Kaspersky Internet Security 7 in my PC and every time I start my PC, I get the following virus alert.



Although I choose the option of "Delete" every time, I still get the same alert next time I start my computer. Is my PC still infected and how can I clean it?

Thank you.

[Phantom010]

It probably can't be deleted. Did you try only quarantining it? Try running a scan in Safe Mode.

After trying the above,

Please download and install HijackThis by clicking here.

Run it and select Do a system scan and save a logfile.

The log will be saved in Notepad. Copy and paste the log in your next post.

Do not fix anything

[perfume]

Originally Posted by go4saket

Hi Guys!

I am using Kaspersky Internet Security 7 in my PC and every time I start my PC, I get the following virus alert.



Although I choose the option of "Delete" every time, I still get the same alert next time I start my computer. Is my PC still infected and how can I clean it?

Thank you.

Dear go4saket, KIS is not named 7 or 8, it's either 2009 or as srprashant pointed out the beta version of 2010 is out for testing and i hope his PC goes crazy while he tests it! I have the KIS2009 version and when i installed MS office and did a full scan ,KIS detected nine "vulnerabilities" whose "criticality" was rated between "highly dangerous" to "very dangerous". So, i submitted every file to Jotti online malware scan where around twenty A-Vs test the file and the verdict in every case was "o.k". The final nail in the coffin was Kaspersky A-V is also among the twenty A-Vs there and it too returned as "nothing found" I suggest you submit the suspect file to jotti as you know the path of the file which is displayed there. If you right click in KIS under "detected", you should be offered a choice to "exclude"the file from further scrutiny. Another excellent option available to you is to run an A-V scanner from Panda or Trend-Micro and see if anything is picked up! Hey, my Javascript is enabled, and still no luck. Can't get the smilies to work! Imagine a smile and a thumbs up!

[perfume]

Sorry, now the paragraphs are also gone! Looks like FF3 is bewitched or is it a "browser hijack"? What's happening, Dear friends, are you there? Lend a helping hand to a struggling teenager! Ran MSRT and as i do everyday, ran SAS Pro and MBAM and KIS full scan! Nothing wrong was found!

[Phantom010]

Please download and install HijackThis by clicking here so we can try to verify all this.

Run it and select Do a system scan and save a logfile.

The log will be saved in Notepad. Copy and paste the log in your next post.

Do not fix anything

[perfume]

Dear Phanton010, I guess you're asking me? Am i right?

[blitzkreig]

perfume,
Who is testing the beta of kis2010?

[Phantom010]

Originally Posted by perfume

Dear Phanton010, I guess you're asking me? Am i right?

No, I'm asking the OP again.

[blitzkreig]

Dear go4saket,
Please run a rootkit scan using trend micro rootkit buster or avg anti rootkit, if it doesn't detect or remove any rootkit, please post this problem in the malware removal and hijackthis forum.

[Cookiegal]

That's actually what called an Alternate Data Stream or ADS for short and it's created by programs that are installed which use PRO-Tector for`copy protection/activation. If you have this line in your HijackThis log then this would be the case here.

O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\WINDOWS\system32\astsrv.exe

http://www.systemlookup.com/O23/284-astsrv_exe.html