Please help me! [Solved]

Hi! I'm wolf, and (you knew it) I've got a virus in my PC. I just know it's a malware.

It came along with koplayer android emulator. I am not sure that it came with koplayer or not, but I saw one of my antivirus program classifying it as a virus. 

***INFO***

File name: adb.exe

Risk: Severe

Comments: Please reply. I am not telling a joke.

***END***

I'm a software engineer, and all my files are in this pc. Please respond fast.

***EXTRA ISSUES***

I am pretty much sure that this virus was injected in my pc through that fake URL that was faking the original koplayer website.

One issue is this that my antivirus is good enough but the code is undetectable by them. The antivirus which caught this virus was ByteFence. By the way, if you think it a joke, then don't. And soon after this virus came, my second email id got hacked. So… please help me.

***END***

Yup, and my last word is it that it is stopping some of the services mid-process. Like cmd.exe , tskmgr.exe and Windows Explorer is also getting stopped by it.

Hello The_Lone_Wolf and welcome to the WTT forum.

adb.exe is not a virus. See here.

Do you have any other problems?

Satchfan

I am a software engineer. I know it is not a virus. But it may be a virus in disguise.

(Yup, I know it is an android bridge used in android simulators)

ByteFence is not an antivirus but a potentially unwanted program and it is certainly not a reliable source of malware detection. I suggest you uninstall it.

Submit a file to VirusTotal

Go to VirusTotal and submit the file for analysis:

• locate adb.exe, click on it and then on Open
• click on Send File
• if you get a message saying File has already been analyzed, click Reanalyze file now.

You will get a report back; post the report into this thread for me to see or copy and paste the link to the results page.

===================================================

Note: Please complete the following tasks in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan Now
• when it has finished, leave everything that was found checked, (ticked), then click on Clean and Repair
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Malwarebytes Anti-Malware

You may have Malwarebytes Anti-Malware installed but if not, you can download it from here.

• run the program
• click on the ‘Dashboard’ to make sure everything is up to date, (it is not necessary to upgrade to the premium version of MBAM)
• click on the ‘Scan’ tab, (directly below the Dashboard tab)
• select the Threat Scan option
• slick the Scan Now button
• Threat Scan will begin
• when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
• if prompted to restart the computer, close all other programs and click Yes to restart your computer
• once you are back at your desktop, open MBAM once more
• click on the ‘Reports’ tab
• double-click on the most recent Scan Report
• click on Export, then Copy to Clipboard

Please paste the contents of the clipboard into your next reply to me.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Include with next post:

VirusTotal result

AdwCleaner log
Mbam.txt
Frst.txt
Addition.txt

Satchfan

Your logs are clean.

We’ll run one more diagnostic scan and then an online scan to be sure.


Run RogueKiller

IMPORTANT: Please remove any usb or external drives from the computer before you run this scan!

Close all running programs.

Download RogueKiller to your desktop

• close all running programs
• for Windows Vista/7/8/10, right click -> run as administrator, for XP simply double-click on RogueKiller.exe
• click on Start Scan
• when it has finished, click on Open Report
• click on Export Txt and save the file on your Desktop as RKreport.txt
• copy/paste the content in your next post
• NOTE: DO NOT attempt to remove anything that the scan detects –everything that is reported is not necessarily bad

===================================================

Download ESET Online Scanner and save it to your desktop.

• right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• when the tool opens, click Get Started.
• read and accept the license agreement.
• at the Welcome to ESET Online Scanner window, click Get Started.
• select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• click on the Full Scan option.
• select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time.
• when the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature: click on Continue.
• on the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

Satchfan

Hello The_Lone_Wolf

It has been several days since I sent my last set of instructions to help with your computer problem.

Please let me know if you still need help. If I don't get a reply within 24 hours I'll assume all is well and close this topic.

Satchfan

Sorry, I was sick I couldn't reply.

And I cannot download ESET. It's not getting downloaded.

RK.txt:

Apologies for the delay but I had no notification of your reply.

 

Sorry, I was sick I couldn't reply

Hope you are feeling better now.

I would say that's another false-positive regarding emulators.

=================

Let’s run a different scan.

Please be patient as scanning may take some time. If you have problem running the scan, you might want to disable any real time protection that you have.

• click here to go to BitDefender QuickScan page.

For Firefox and Chrome users:

o    Click on Scan Now. You will be prompted to install a plug-in: allow it. (In case you get stuck, refresh the page to try again).
o    A Software Installation window will appear. Click Install Now and the plugin will be installed as an Add-on.
o    Restart Firefox when done. Go back to the BitDefender QuickScan page again and click on Free Scan Now and proceed accordingly.
 

For Internet Explorer users:

o    Click on Scan Now. You will be prompted to install an ActiveX control. Please install.
o    The page will refresh. Click on Scan Now again and proceed accordingly.

• when the scan has completed, click on View report and a Notepad log will open.
• if there are any infections found, you will get a warning and the link to the report will be displayed as the number of infections. Click on it.

Post back the contents of this report. It can also be found at C:\Documents and Settings\\Application Data\QuickScan, (“username” is the Windows log-in name).

Satchfan

Uhh… The link you sent is directing me to www.bitdefender.com/toolbox/  .

P.S. fix the link you sent.

And I trust nox, it's the first time in years that it is being detected as a virus.

~Wolf

Hm. Even BitDefender's own website give the link to the 'toolbox'!!

Let's see if this works :

F-Secure Online Scan

• please run F-Secure Online Scan
• follow the Instruction here for installation
• accept the License Agreement
• once the ActiveX installs, click Full System Scan
• once the download completes, the scan will begin automatically
• the scan will take some time to finish, so please be patient
• when the scan completes, click the 'Automatic cleaning (recommended)' button
• click the ‘Show Report’ button and copy/paste the entire report in your next reply.

Satchan

Hi Wolf

It has again been 3 days since I replied to your request for help with your computer problems.

Please let me know if you are having problems and still need help.

If I do not hear from you within 24 hours I'll assume that all is now OK and close this topic.

Satchfan

Uh… There's a problem. There isn't any such option to 'see the report'. I may have been in older versions but it isn't there currently.

F-Secure's own website says there should be an option to Open last scanning report.

Did it show that anything was found?

I'm sending a screenshot. Link below:

https://1drv.ms/u/s!AhZ1A0P7jub1uCigcLf2_QAfij4a