How to delete these threats

B

Hi

I was reading on the internet that last.exe and updateloader.exe are threats. So, how to remove these files without affecting the rest of the system? The first .exe file is in C:\Documents and Settings\Computer\Local Settings\Application Data\Xenocode\Sandbox\COMODO \4.00.0002\2010.11.27T19.25\Virtual\STUBEXE\@APPDATA@ I am not able to delete it. The license of my KAV was finished so i installed the latest version and it was also not able to delete this file.

Thanks

Boot from Live CD of Linux and delete them manually. Simple.

Try Malwarebytes free version and see whether it can detect them or not.

B

gameranand said:
Boot from Live CD of Linux and delete them manually. Simple.

Thanks for replying. Sorry i don't know how to do that.

Gearbox said:
Try Malwarebytes free version and see whether it can detect them or not.

Thanks for replying. I will do that and will let you know.

Another thing I was using KAV 7 from the past many many years. It worked great. A couple of weeks ago its license got finished. No free keys were available for this version. So about two days back i purchased KAV 2011. Now when i installed it, it automatically started deleting files like few games for the kids from miniclips and kept on bothering again and again about this last.exe so i uninstalled it. I couldn't find the option of stopping it from deleting files without asking me. So, the questions i wanna ask is that is KAV 2011 fine for my pc ( Win XP SP 2, P4, Intel(R) Pentium(R) 4 CPU 2.66GHz, Ram 1 GB) ? How to stop it from deleting files without asking me?

A

Gearbox said:
Try Malwarebytes free version and see whether it can detect them or not.

+1 for Malwarebytes. My gadgets are affected from My Pictures.exe. Malwarebytes get every thing done !!!

billubakra said:
How to stop it from deleting files without asking me?

Under settings, untick the box "Select actions automatically".

B

a2mn2002 said:
+1 for Malwarebytes. My gadgets are affected from My Pictures.exe. Malwarebytes get every thing done !!!

Thanks for replying. Man you are from my state, ki halchal?

Gearbox said:
Under settings, untick the box "Select actions automatically".

Thanks for replying. I did the same thing but still it kept on deleting files. Any other help? I can't find any keys for KAV 7 and i can't use KAV 2011 because it is deleting files

Did you mean this software?
Malwarebytes : Free anti-malware download
Should i download the full version or is the free one ok? These .exe files which are giving me troubles are these some kind of virus or something?

W

how can you use KAV2011 when kaspersky stopped making/distributing it years ago?latest version is 2013 so use that.all kaspersky keys are compatible with various year versions so 2011 key will work with 2013 & soon to be released 2014 version.read inbuilt kaspersky help in software which is very detailed to see which option to use to prevent auto delete of files.

B

whitestar_999 said:
how can you use KAV2011 when kaspersky stopped making/distributing it years ago?latest version is 2013 so use that.all kaspersky keys are compatible with various year versions so 2011 key will work with 2013 & soon to be released 2014 version.read inbuilt kaspersky help in software which is very detailed to see which option to use to prevent auto delete of files.

Actually I got it from a retailer at a discounted price. Kaspersky Lab in my country says that they still give updates for this version so i bought it. Will KAV 2013 work fine with my system? And does it delete files automatically without asking, even when you have selected the do not delete option? No sir, all years have different keys so keys of 2011 version won't work with the 2014 version.

B

whitestar_999 said:
how can you use KAV2011 when kaspersky stopped making/distributing it years ago?latest version is 2013 so use that.all kaspersky keys are compatible with various year versions so 2011 key will work with 2013 & soon to be released 2014 version.read inbuilt kaspersky help in software which is very detailed to see which option to use to prevent auto delete of files.

Actually I got it from a retailer at a discounted price. Kaspersky Lab in my country says that they still give updates for this version so i bought it. Will KAV 2013 work fine with my system? And does it delete files automatically without asking, even when you have selected the do not delete option? No sir, all years have different keys so keys of 2011 version won't work with the 2014 version.

W

i used same activation code(different from keyfile) to activate 2012 & 2013 version.
Internet Security & Anti-Virus | Updates

A KIS 6.0 license is not compatible with the latest version

any kaspersky key/activation code for version 7.0 or above(which includes 2010,2011,2012) works with 2013 & most likely will work with 2014.

billubakra said:
Thanks for replying. Sorry i don't know how to do that.

Here is how

1. Download Ubuntu Iso
2. Download Live Linux USB Creator
3. Create a bootable pendrive using Live Linux USB Creator
4. Boot from Pendrive and select try Ubuntu when asked
5. Delete the file from its location.

billubakra said:
Actually I got it from a retailer at a discounted price. Kaspersky Lab in my country says that they still give updates for this version

Where're you from?
Whether Malwarebytes detected those files as threats?

W

those files are inside comodo sandbox & i suspect that comodo has somehow locked these files but they should not be able to do anything outside the sandbox.

T

@OP: Have you performed Windows Updates?

B

whitestar_999 said:
i used same activation code(different from keyfile) to activate 2012 & 2013 version.
Internet Security & Anti-Virus | Updates

any kaspersky key/activation code for version 7.0 or above(which includes 2010,2011,2012) works with 2013 & most likely will work with 2014.

Thanks for replying. I don't know man but here keys or activation codes for one version doesn't work for another.

gameranand said:
Here is how

1. Download Ubuntu Iso
2. Download Live Linux USB Creator
3. Create a bootable pendrive using Live Linux USB Creator
4. Boot from Pendrive and select try Ubuntu when asked
5. Delete the file from its location.

Thanks for replying and for the step by step guide. Actually i do not have much knowledge about all this. So i can't take the risk, but thanks again.

Gearbox said:
Where're you from?
Whether Malwarebytes detected those files as threats?

Thanks for replying. I am from India, a country ruled by dumbasses. I installed the software, KAV 7 said that it is mbm.exe is trying to run hidden or something, i added it to the trusted zone but it never opened later on. An icon of it was shown near the lower right side of the screen but it didn't open.

whitestar_999 said:
those files are inside comodo sandbox & i suspect that comodo has somehow locked these files but they should not be able to do anything outside the sandbox.

Thanks for replying. Yes you are right they don't bother me but KAV detected them as trojans so i am worried. What are these last.exe and updateloader.exe files anyway? And what is this comodo sandbox?

theterminator said:
@OP: Have you performed Windows Updates?

Thanks for replying. Yes updated.

Guys anyone knows why is KAV 2011 deleting files automatically even though i selected Select actions automatically option? Any step by step guide for this?

*UPDATE*

I am using an old pc, the configuration isn't high so installing MB slowed it down and it didn't open. Just now i restarted it and i blocked last.exe because KAV recommended it to me. KAV rarely tells me to block it whenever computer is restarted

*oi41.tinypic.com/2eockjr.jpg

(KAV is not activated because i switched back to KAV 7 , since KAV 2011 was automatically deleting files and unfortunately now the updates for the former version is not there)

After this i got a message last.exe has stopped working and it will be closed. Anyways i ran MB after that and it detected two files one being last.exe as backdoor poison and the other one was from error repair pro. Anyways i deleted both of them. It said they have been quarantined and deleted successfully but after the restart the last.exe file is still there

What should i do now?

W

comodo is a well known free firewall & antivirus software.sandbox is a feature which basically creates a separate/quarantined zone in which suspicious programs are run to see/analyse what they do without affecting the real system outside the sandbox.

Reset Sandbox, Sandbox Computer Security, Network Access | Internet Security v6.2

T

Try contacting KAV support. You paid for the software. I am sure they will have a solution.

B

whitestar_999 said:
comodo is a well known free firewall & antivirus software.sandbox is a feature which basically creates a separate/quarantined zone in which suspicious programs are run to see/analyse what they do without affecting the real system outside the sandbox.

Reset Sandbox, Sandbox Computer Security, Network Access | Internet Security v6.2

But i never installed comodo. So how are these folders and files in my pc?

theterminator said:
Try contacting KAV support. You paid for the software. I am sure they will have a solution.

I did email them many nights ago, they said that they will call me but no calls as of now.

T

billubakra said:
I did email them many nights ago, they said that they will call me but no calls as of now.

Try these numbers:
Kaspersky Consumer Support Contacts:

1-800-209-2012
+91-20-2701-2834
+91-20-65111015

Source: support.kaspersky.com

B

theterminator said:
Try these numbers:
Kaspersky Consumer Support Contacts:

1-800-209-2012
+91-20-2701-2834
+91-20-65111015

Source: support.kaspersky.com

Thank you. They are off will holla them on monday.

@gameranand

Since i have no idea how the folders and files of comodo came into my computer and since i am not able to find another way. Can you please explain thoroughly how to delete this file using linux cd? This procedure is safe, right i mean will it effect the rest of the system? Please provide the download links also.

W

just to be safe post your issue in comodo forums because it is not possible for sandbox folder to exist without an install of some comodo or comodo related software.deleting only those 2 files from linux cd should be safe though.

B

whitestar_999 said:
just to be safe post your issue in comodo forums because it is not possible for sandbox folder to exist without an install of some comodo or comodo related software.deleting only those 2 files from linux cd should be safe though.

Thanks for replying. Will do that. Is hiren boot cd better than linux boot? Also sometimes this last.exe shows up in the task manager and i manually close it.

W

hiren boot cd is better in the sense that it also has a live xp option using which you boot into live xp mode & since most people are familiar with windows xp this is very user friendly.

B

whitestar_999 said:
hiren boot cd is better in the sense that it also has a live xp option using which you boot into live xp mode & since most people are familiar with windows xp this is very user friendly.

Thanks for replying. Can you please tell me the steps regarding how to do that? And if possible please pm me the download link.

BTW here's the link of last.exe that i uploaded on virustotal

*www.virustotal.com/en/file/373dc9b...651309faf3674cff4991f6b8/analysis/1375729797/

I called Kaspersky support today they said that version 2011 will not get updates after 28th august and said to try using the key of 2011 for 2012 or they will issue a refund.

T

One thing you can also do is to perform an Online scan from ESET's website.

W

Download Hiren

use any cd/dvd writing software like nero & use burn image option(don't use burn data cd/dvd option).after that simply boot from the cd & follow instructions.select live xp mode option & you will boot into a xp like interface.go to the folder & delete those 2 files.

B

whitestar_999 said:
Download Hiren

use any cd/dvd writing software like nero & use burn image option(don't use burn data cd/dvd option).after that simply boot from the cd & follow instructions.select live xp mode option & you will boot into a xp like interface.go to the folder & delete those 2 files.

Thank you for posting the link. I booted via HBCD then selected mini windows option and then i tried to delete the whole Xenocode folder from my computer but it kept on saying cannot find path of comodo folder or something. I then tried deleting the folders inside Xenocode folder but it gave the same result. Now when I start the computer that last.exe is still there in the task manager and I have to close it manually. What should I do now? Can linux cd do the job?

I was able to change the name of Xenocode folder to anything, I changed it to Xenocodeeee but now it has changed back to the original all by itself.

W

then it means that the actual file/folder is not there in location you mentioned.there is simply no way that you can not delete something from your hard disk when booting from a live linux/xp/any cd.boot into normal windows install & then from task manager right click last.exe process & select properties which will show you the exact file path.

B

whitestar_999 said:
then it means that the actual file/folder is not there in location you mentioned.there is simply no way that you can not delete something from your hard disk when booting from a live linux/xp/any cd.boot into normal windows install & then from task manager right click last.exe process & select properties which will show you the exact file path.

Thanks for replying. The file is there in that location. Am i missing something? Normal windows install, is this an option in the HBCD because currently I am using the windows and when I right click a process in task manager it doesn't show the file path.

W

i meant the task manager in windows installed in your hard disk not the one in cd.also post screenshots of last.exe path from task manager & its properties from windows installed in your hard disk.

B

whitestar_999 said:
i meant the task manager in windows installed in your hard disk not the one in cd.also post screenshots of last.exe path from task manager & its properties from windows installed in your hard disk.

Yes i got that but i am not able to get the path location, i mean where is the option. I already closed last.exe manually this ss is just to show that i am not getting the path option

*oi40.tinypic.com/awpwg.jpg

It's properties

*oi41.tinypic.com/33a3sbd.jpg

W

in properties window move the cursor over location(C:\documents & settings........) & a popup box will show the exact location of last.exe file.btw did you try scanning your pc with some antivirus rescue cd:
Comprehensive List of 26 Bootable Antivirus Rescue CDs for Offline Scanning

B

whitestar_999 said:
in properties window move the cursor over location(C:\documents & settings........) & a popup box will show the exact location of last.exe file.btw did you try scanning your pc with some antivirus rescue cd:
Comprehensive List of 26 Bootable Antivirus Rescue CDs for Offline Scanning

I hope this is what you have asked for

*oi44.tinypic.com/osew50.jpg

*oi42.tinypic.com/29lk8dl.jpg

No, I did not scan it with that. Do you think booting with linux can delete these files since HBCD was not able to do the job?

W

you can use linux with HBCD too(other options beside mini xp option screen).

B

whitestar_999 said:
you can use linux with HBCD too(other options beside mini xp option screen).

Sorry for the late reply. I am sorry I am a bit busy these days. Sorry but I dont' know how to use them together. Like I mentioned HBCD was not able to delete them, can linux do the job? If yes then which version do you recommend?

Download Ubuntu Desktop | Ubuntu

Any version will do.

B

gameranand said:
Any version will do.

Thank you so much for replying. Last question, do you think Linux is superior to HBCD? I want to be sure before downloading as the speed here is very very slow.

W

HBCD also contains a linux version too besides mini xp so why download extra.as for superiority it depends on whether you know how to use & when to use all the softwares provided in various linux cd compared to HBCD.