View original (French)

How to remove bagle.zip?

Solved
melomaniax Posted messages 4 Status Member -  
bazfile Posted messages 58483 Registration date   Status Moderator Last intervention   -
Good evening, for a few days I've been having a problem
I have a virus named trojan.tr/bagle.zip that has installed itself. It hasn't caused any issues on my PC (except for the fact that I sometimes have to reinstall Ableton because Windows can't find the information to open it, but I'm not sure if it's related)

Anyway, several times a day, Avira quarantines several bagles, I delete them but they always come back. I ran a scan with Malwarebytes but it doesn't find it.
Avira (a free antivirus) indicates that these bagles could come from the quarantine folder of McAfee (which I no longer have because I had the "demo"), which is located in the program data. However, I cannot delete the files in that folder because it says I need to be an administrator to do that, and even though I try a workaround to be an admin, I still can't.

Does anyone know how to remove this virus from a PC? I've been looking on many forums, but I haven't seen any problems similar to mine... thank you!

1 answer

Answer 1 / 1
bazfile Posted messages 58483 Registration date   Status Moderator Last intervention   20 265
 
Hello,
Download FRST, once downloaded save it on the desktop, then open it and you will see this:

Then check the shortcut box like this:

Click on Analyze, at the end of the analysis you will have three text files on the desktop: FRST, Addition, and Shortcut, make sure to wait for the messages indicating that the analysis is complete, then send these reports to https://pjjoint.malekal.com/ see this tutorial paragraph Send the analysis reports to pjjoint, then provide the three links generated by Pjoint in your next message.

--
bazfile
Moderator/Security Contributor.
a hello, a reply, a thank you are always appreciated.
0
melomaniax Posted messages 4 Status Member
 
Thank you for your response and your help! Here are the links:
additions: https://pjjoint.malekal.com/files.php?id=20201216_i11m14b9r8n6
FRST: https://pjjoint.malekal.com/files.php?id=FRST_20201216_f9f6f7w7e12
shortcut: https://pjjoint.malekal.com/files.php?id=20201216_u8g13g11o15d8
0
bazfile Posted messages 58483 Registration date   Status Moderator Last intervention   20 265 > melomaniax Posted messages 4 Status Member
 
Hello,
McAfee is not uninstalled.

First uninstall the following software:
- McAfee LiveSafe to completely uninstall it, use the MPCR see THIS PAGE.
- SSOption uninstall it with Revo Uninstaller in Advanced Scan mode, see the tutorial at the end of the message.

Procedure to follow in the order indicated:

1- Open FRST
2 - Copy the entire script in the box below: 
Start::
CreateRestorePoint:
CloseProcesses:
Startup: C:\Users\louis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RUNDLL32.EXE.lnk [2020-10-03]
ShortcutAndArgument: RUNDLL32.EXE.lnk -> C:\Windows\System32\rundll32.exe => C:\PROGRA~3\277EE2~1.DLL,SRYzbEGeBQ==
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction 
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction
HKLM\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1895922319-1922835177-1671687324-1001\...\Run: [] => [X]
ShortcutTarget: Host Services x64.lnk -> C:\Program Files\qemu\Host Services x64.exe (File not found)
S2 PerfectTeviso; C:\Program Files (x86)\PerfectTeviso\PerfectTeviso.exe -system -token 95de1f [X]
U1 aswbdisk; no ImagePath
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Host Services x64.lnk [2020-12-12]
ShortcutTarget: Host Services x64.lnk -> C:\Program Files\qemu\Host Services x64.exe (File not found)
EmptyTemp:
End::

3- Once the script is copied, click on Fix.

Let the fix run, and once it is finished, you will be asked to restart your PC. Do it as soon as prompted, see below.
Then once your computer has restarted:
4- You will have a Fixlog file on your desktop, send it via https://pjjoint.malekal.com/ and then put the link generated by Pjoint in your next message.

5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT


Tutorial for Revo Uninstaller

Here’s how to uninstall a program in Advanced Scan mode.






Accept the uninstallation of the program you wish to uninstall, and if there is an error message saying that the uninstallation is impossible, close the error message and continue with the procedure.


Check "Advanced Scan" and then click "Scan".


Click "Select All" then click "Delete", if a second list appears, do the same, and once everything is deleted, click "Finish", a restart may be requested.

0