Well I'm sure glad things got fixed. And I just learned something new today.. F5 to refresh. Never too late to learn new things. I'm computer shopping.. hubby's died over the weekend, and we NEED it to do our work. I suspect it might be the power supply got hot and it shut down and then did all kids of horrible things like the blue screen and errors. It is 10 years old, so guess it's time to get a newer one. He said I can have the new one since I live on my computer and he'll take this 3 year old Dell. Main thing I want is NOT to have it with Vista... gotta be XP or nothing! In the meantime we'll just keep shutting his down between using it to keep it from heating up. In fact time to blow mine out too.. the case is feeling rather 'warm'..

To my Wonderful Ambassador

What can I say!!!???

Lotzz of HUGGZZ :D

Hummm ...

It changed pages, but I just added messages on Page 1, one of which is for Ax.

I'm posted tooooo many messages I guess :*)

Hellôôô ~Robert~

•Thank you for taking the time
•Thank you for all the useful info
•Thank you for the help
•Thank you for the laughs :*)

Merci Beaucoup indeed
A smiling Princess,
Manu

Hi Violet

Strange though, that site always states rather vague information, doesn't it?!!!
Even for well known software ...

I'm thinking they want to push their product, more than really help.

Thanks for taking the time,
Manu

Hi Brad

Yes, clearing the Temp is what we did.
Then scanned again, re-booted (or tried to ...), then re-scan w another scanner / re-cleaned - ...

Indeed, a very interesting couple of days - *NOT*!!!

Thank you for the help,
Manu

Buenos Dias Ax

¿Cómo está Usted?!! Hace mucho q no hablamos!! ...

Yes, I know about the F5 function :D
Was just trying to be funny, looking for Robert's song in there ... :*)
I use FF but yes, it works on all browsers.

Muchas Gracias,
Manu

Bonjour everybody!!!

Phewwww, finished battling the Dragon ...

The sick machine (Acer Laptop) also has a hardware problem, ie the "On" button has a mind of it's own and functions only when it feels like it!!!
It's a major problem, cause it's connected w the Motherboard. Trying to manage it so it last for a while longer.
So we seldom close it down, which we had to do several times during the cleaning process of that critter.

Couldn't put it "On" again for the longest time in between each closing...
We are using it as is, a first evaluation was rather dim - everything is connected on laptops so it would be *very* expensive to repair :-(

Anyway, apparently all is back to normal now!!! :D ... As long as I don't shut it down ...

Really want to THANK EVERYBODY that came to the rescue!!

Geeks Unite!!! Yeahhhh ...
A very relieved Princess,
Manu

Good morning Princess,
:)

You've probably solved the problem by now by deleting those files in your Temp folder
manually or with CCleaner.
I should have told you ,that whenever you open a zip file it extracts itself to the Temp folder.

Amicalement,

~Robert~

yes, the temp thing seemed very strange...even to me, the non-expert...

then i searched...and found this surprise:

http://www.prevx.com/filenames/X1622114754927674195-0/FLOOLA.EXE.html

partial: FLOOLA.EXE has been the subject of the following behavior(s):
Executed from Temporary Folders

odd...

you can pretty safely delete everything in your temp folder. The worst that may happen is you lose a few preloaded preferences from web pages and the like. Nothing functionally important is stored there.

it's strange that anti virus/malware software would move a file to there. I would clear the temp folders and run the scan again. Trojans need to be activated (whether by an application or direct clicking) to become functional, so deleting/moving/copying will not activate the actual code within.

Bonsoir La Princesse,

I´m sorry that the bug is still bothering you. I´m sure it´ll get fixed with all the help you got here. Unfortunately I can´t help with the bug, but if the trick Robert is using to confuse you is still bothering you, I´ll have you know that it is just a shortcut for renewing the browser´s page to see if there are new posts. I don´t know if other browsers use the same key, but IE does, so it is pretty harmless.

Prochaine,

AxCut

Well, one shouldn't cry victory too soon!!!

Kaspersky started screaming again :-(

Now it says the Trojan is in the Temp files ...
Button Delete & Desinfect are both greyed out ...
Gonna do a pass w cCleaner, that should help I think!

Will do a deep scan afterwards.
Probably will take all night

Will post the results tomorrow morning I guess!
Princess of the Mango Order

Hi Ambassador

Ahhh HaHa
Indeed, typical Londo.
And typical Earthers

As usual, can't figure out how in the hell u can come up w this stuff always so à propos - always so quickly ...
Hummm, magic me thinks !!! ;-)

Princess of Clowness

No problem LeKanaw, if you follow the main steps, like using the SAS and Anti-malware bytes, you should be better of if you have any trojan problems again....

Bonjour FullBug!!

With all the confusion I didn't see you there!! Sorry!!!
Yap, seems I'm blind too now ... *sigh*

Thank You very much for the link!! Just peeked briefly, it does look very useful.
They seem to have a few tutorials too :D
I'm going to BM it right away. Will explore it more for sure.

Thanks again
Princess of Mango

Ok Then ...

• Clicked Delete button on Kas
• Used my new trick Shift/Delete on the zip
• Started a scan w A² - It hasn't started on D:\\ yet, it's still scanning C:\\
• Took out my Special Sword & been doing the Hokey-Pokey, as per Ambassador's instructions ;-)

Waiting for results ... from A² ... *not* the Hokey-Pokey!!
Should I do a scan w Kaspersky afterwards?
If so, it'll probably take a couple of hours at least, wont know the results right away.

=*=*=*=*=*=*=*=*=*=*=*=*=*=
~Robert~

What is this "F5" thing you speak of? Is this a another trick??
Maybe trying to confuse me, are you??
I tried it see, but there wasn't any song hiding in there ;-) Haaa AhAhAhhhh

Because you know, the Swords are out now! I'll chase you down ...
As you know I run fast and I always catch you!!! :*) Muhahaaahwaaa

Princess of Clowness

Well, someone has to keep you calm, Little Princess. :)

As Ambassador Londo said....

"Londo: These Earthers! I try to find out as much as I can about them to try to make some sense of them, but it never seems to come together.
Delenn: They do seem to be a mass of contradictions.
Londo: Exactly my point! Here–six thousand years of recorded history, a history that includes remarkable composers, astonishing symphonies! But what is the one song that half of them sing to their children generation after generation?
You put your right hand in,
You put your right hand out.
You put your whole self in,
And you turn yourself about.
You do the hokey-pokey,
You give a little shout.
That's what it's all about!
It doesn't mean anything! I have been studying it for seven days! I had the computer analyze it! I swear to you, it does not mean a thing!
Delenn: We've come at a bad time, haven't we?"

Hi Robert! Just wait until Londo finds about Mambo No 5. His hair will even curl more.

Thank You Ambassador :*)

You silly, you are making me laugh!!
Can always count on you to calm me down!
Luv u

Princess of the Mango Order

Hi Delenn,nice of you to join us.I should hit that F5 more often.
Will mambo no 5 do..?
;)

Bonjour Ambassador :*)

Gee, so stress out, only now saw your post!! Sorry

Yes, I suppose it could be a FP.
I'm still wondering, it's possible this critter latched itself on to that zip, right?
Could have been another zip or another file, it was that one by chance, oui?

~Robert~
Ahhh, did not know about the Shit/Delete trick
Thank you!!

So I'm going to go click "Delete" on Kas now.
Then will delete the zip.
I'll be back right after

Just so great you all came to the rescue!!!

I would suggest doing the "Hokey-Pokey" then ...... crossing your fingers behind your back.

Then delete. :)

Princesse,

Any way that you want will do.

You can use the delete option of Kas too.Disregard A2.
I suggest crossing your fingers behind your back.LOL.
:) :*

Or disregard Kas and A2 and simply use 'delete' button, but in this case you will have to remove the file from your recycle bin too (la poubelle)

PS Using shift+delete buttons bypasses the recycle bin

Hi ~Robert~

As u say, no need to keep the file - Indeed I intend to delete it ASAP!!!!!!!!!
I just didn't want to do *anything* b4 knowing the whole procedure.

For now, Kas *and* A² are waiting for instructions:
• Kas: Delete
• A²: Quarantine or Delete

Just wondering in what order I do it, what precautions to take, etc, etc, ...
Do I delete the zip now or *after* A² and/or Kas have done their thing?

Plus do I cross my fingers behind my back or in front??
You know ... just in case ...

Also, what do u mean by "Shift Delete"
Never did that ... How is this different from "Delete"??

Mangoette :*)

Thank you, Robert.

That is exactly what I would have said; but GAOTD wouldn't let me sign in.

Mango Princess, delete the zip and rerun your scan. It was more than likely a FP since you had the file on your PC since May.

Hi ~Robert~

•• The file that's infected is in the dwld Basket on D:\\
•• The infected program is Floola-win.zip/floola.exe

The program itself was uninstalled in May.
Only the zip remains.

Thanks

Manu,

I have reread this thread.I suggest deleting the zip file (use shift-delete buttons).
This probably will solve your problem.
:)
(no use keeping a zip file of a program you don't use anyway,is there..)

I always follow this guide, and its worked for me everytime.....
http://www.computerhope.com/forum/index.php/topic,46313.0.html

Manu,

Bonsoir.

Yes ,please tell me the name of the file that is (supposed to be) infected.
Oui, donnez moi le nom du fichier qui semble être infecté.
And it's location...
Et ou il se trouve..

Salut ~Robert~

Merci d'être venu :*)

As I said in the first post:
Kas says: dropper.win32.agent.vhe
A² scan says: dropper.win32.agent.ucd

Hummm, maybe this is not what u'r asking, is it?
Tu veux savoir le nom du programme infecté? Ou ce q me dit Kaspersky?