Need to request a remote session and advice
I have a virus and am hoping experienced members might be willing to help me. First I will explain what happened, and then I will ask for help on particular questions I have
Yesterday while online, and having about 15 pages opened on Internet Explorer, I got a message from F Secure saying a virus had downloaded and "Virus could not be removed." It identified the virus as Trojan.HTML.Redirector.U and advised me to contact F Secure. I tried to connect but apparently it was outside of business hours and nobody was there so I sent an email.
I ran the F Secure cleanup tool followed by a complete computer scan and then the cleanup tool again, all three showing no malware found.
My email response from F Secure was to recommend that I request a remote session and I was given a phone number to call, but the email came outside of business hours and it is now Saturday and F Secure is closed. I have not seen anything suspicious on my computer but am not visiting sensitive sites such as banking until I get this resolved.
I need to know what hour to call. I am in the Eastern time zone of the USA, and do not know if the times to call (9 to 16) are GMT and need to be converted to that, or some other time zone. I am 70 years old and know nothing about computers, so am depending on this community for help and advice. Thank you for any help on this
Comments
-
Hello Jack,
First of all, have you checked your F-Secure Quarantine folder to see if there is anything there? You'll find it in a link on the Settings > Virus Protection screen (terminology may differ slightly depending on your version of F-Secure). If it's listed there, then it means that your computer is safe. The message that F-Secure "couldn't remove" the virus may mean literally that, but it still may have been blocked from running, if that makes sense.
Secondly, I would suggest downloading and running a scan with Malwarebytes and see if that finds anything. Come back to us when you've done that and let us know how things go.
-
Simon, the program installed okay and I ran it and found a bug called RRSavings.A which was in five different places on my computer. The program cleaned it off okay and I restarted the computer. I don't know if this is the one F Secure advised me about or not (at the time I got the F Secure warning, F Secure called it "Trojan.HTML.Redirector.U"
-
To be honest, if you've scanned with MWB and it found and removed that, plus you've done full scans with F-Secure (have you also used the Online Scanner?), then I think you should be fairly confident that the machine is clean. There's another one you could try, which is Kaspersky's TDSSKiller, if you feel like it. I would recommend that you keep Malwarebytes installed and running, as it acts as a good second line of protection.
http://usa.kaspersky.com/downloads/TDSSKiller -
@Jack wrote:No, nothing in Quarantine. I wonder if I should still request a remote session from F Secure when they open on Monday?
That's entirely up to you, Jack, but if it would give you piece of mind, then it probably won't hurt. Just make sure you go direct through www.f-secure.com as we had a recent incident where someone got caught out by a rogue support website, and they were charged a substantial fee. F-Secure support is always free.
-
-
@Jack wrote:Again, can I run TDSS killer with F Secure running? And can I install it with F Secure running? I am not too up on computer things.
I think you can run the scan with FS running, but if it complains, try temporarily disabling FS in Tools. This one is only a scanner and you don't need to leave it installed once the scan is complete.
-
@Jack wrote:Okay, downloaded it, ran it, no threats found. Thank you very much for helping me Simon, I feel much better. Still worried about doing online banking, they asked me to download something but I haven't responded for a few days since getting the F Secure warning
Can I ask what it was they asked you to download? If it's Trusteer Rapport, I'd advise you to avoid it as it may not work with FS.
-
Hello,
Sorry for my reply.
But when F-Secure prompted about current detection (about trojan.html-redirector)?
Does it's just as pop-up during idle for system and by real-time scanning (background).
Or comes as "result of manual scan" (full scan).
Or during use a browser?
Anyway... if Quarantine not helpful. Can it's be that else one place have information about "detection"?
I mean -> main user-interface of F-Secure (AV/Computer Security). Settings. Part about manual scan or real-time scanning.. and there will open "History of removal spyware and viruses" (Removal history list). There can be information about ?! this notifications. such as it's can be marked that "mistake" during action.
Such as.. it's anyway should be placed under some of?!?! (if it's not placed under log-report as result of scan).
Also with "pop-up/notification" should be also information about "file" - where is it... and how it called. ?!
With current information (where and which file triggered deteection) you can to understand what is it.
It's can be, for example, part of zipped archive. And it's not available to be removed automatically. But you can to do manually.
And it's mean you system can be safe, but just "static" file with "malicious signature". Or something else.
If it's happened during browsing.. so.. maybe trouble with page.. which trying to use something as "exploit".
-
Thank you Ukko. It came up during browsing with Internet Explorer. It said "failed." I think Simon's help may have got it, although F Secure identified the virus as "Trojan.HTML.REDIRECTOR.U" and the one I found with Simon's help was called "RRSavings.A" I am assuming they are the same thing? Anyhow, that one is cleaned
-
Jack, I see you already received good help but I don't think anyone has informed you about this yet, to ease your mind:
"When an F-Secure security product reports anything malicious on your computer it has already detected and stopped it, preventing it from causing any harm to your system or your data. Our security software will not remove infected files under some circumstances, they will however do no more harm than wasting your disk space and cause additional virus warnings whenever you or a system process is accessing that file."
From: Viruses were found but were not automatically cleaned. What can I do?
RRSavings.A is not malware but adware, and is classified as a PUP - Potentially Unwanted Program. It display ads typically not associated with the sites you are visiting.
An F-Secure search for "Trojan.HTML.Redirector.U" results in this page: https://www.f-secure.com/v-descs/trojan_js_redirector_i.shtml
Description of what it does: users navigating to a particular website are redirected to a pornographic website
If malware is detected in the Temporary Internet files folder F-Secure recommends that you delete all the files in the folder. Because the files are only cached copies, no actual data is lost.
To delete the files in Windows Vista, 7 and 8:
- Do one of the following:
- Click Start > Control Panel > Internet Options and, on the General tab under Browsing history, click the Delete... button.
- Open Internet Explorer and click Tools > Internet Options and, on the General tab under Browsing history, click the Delete... button.
- Open Internet Explorer and click Safety > Delete Browsing History.
Delete Browsing History - Select the Temporary Internet files checkbox and click the Delete button to delete the temporary Internet files.
From: Cleaning temporary Internet files in Internet Explorer
Even if you don't know where this "virus" file is/was, there's no harm in following the above instructions to clear the cache and browsing history of Internet Explorer.
- Do one of the following:
-
🚩 What Do You Think?
We’d love your thoughts on our fresh look! Quick survey, big impact!