piriformfriend

Thanks Andavari, I appreciate your help.

Thanks Nergal, so you think I should go ahead and use Recuva with no danger for my computer. Am i correct?

The engine that grabbed it is called VBA32. I must admit I have never heard of this engine before but is one of those listed in virustotal.com, as well as virscan.org. Recuva gives the same results in either scans. I scanned locally with Norton and Malwarebytes and I get no positives.

Nergal, I get 2 hits, the first from ESET is negligible – “Win32/Bundled.Toolbar.Google.D” – which is a false positive referring to the google toolbar bundled with Recuva (I get this also scanning Ccleaner). The second, which I reported, is more worrisome. Why should Recuva turn out positive for a known trojan such as “Malware-Cryptor.Win32.General.4”?

I just downloaded Recuva from https://www.piriform.com/recuva/download/standard. I checked the file for viruses and malware in virustotal.com, and one of the scan turned out to be positive. In particular: VBA32 finds “Malware-Cryptor.Win32.General.4” in the downloaded Recuva. I don’t know what I should do. Could please someone help?

Thanks again Nergal. I really appreciated your help.

It is possible that this is just what happened, since the $R3OBKCI.exe file according to Norton was downloaded from download.piriform.com/ccsetup416.exe, and when I clicked on the Norton tab related to $R3OBKCI.exe it redirected me to the recycle bin, to a copy of ccsetup416.exe (I don’t know if it was entire or partial though). I wasn’t aware of windows renaming files in the recycle bin. Do you think this is what happened? I downloaded the free copy of ccleaner. I didn’t see the security alert you mentioned when I clicked the link to download ccleaner. Thank you for your help.

I forgot to mention that I also checked this options in Ccleaner: Add “Run Ccleaner” option to recycle bin context menu Add “Open Ccleaner” option to recycle bin context menu

I have Norton Internet Security, which keeps a record of the files downloaded to my computer. This one, $R3OBKCI.exe, appears to have downloaded after I downloaded ccleaner. By mistake I downloaded twice the ccleaner, so I put one of the two copies of ccleaner on the recycling bin. $R3OBKCI.exe appeared afterwards. The path of the$R3OBKCI.exe file is c:\$RECYCLE.BIN\S-1-5-21-28636295-2780579325-3835481906-1001\$R3OBKCI.exe, but the file seems to disappear immediately after being downloaded, because when I search it in the computer (or the recycling bin) its’ gone (so I can’t test it in https://www.virustotal.com/) This (I believe) is the url where I downloaded ccleaner from: http://pcsupport.about.com/gi/o.htm?zi=1/XJ&zTi=1&sdn=pcsupport&cdn=compute&tm=6091&f=00&su=p284.13.342.ip_&tt=65&bt=5&bts=3&zu=http%3A//www.piriform.com/ccleaner/builds When I compare the ccleaner downloaded from this url to the ccleaner file downloaded from piriform.com, they are exactly the same size (down to the bytes), same dates, and same identical Digital Signature information. I have also run Malwarebytes and Norton Internet Security, without finding any threat. I am at truly at a loss about this file and would welcome any comment. Thank you.

I recently downloaded ccleaner and selected the automatic update option. I noticed that soon after the installation of ccleaner another file was downloaded to my computer, called $R3OBKCI.exe. Is this a legitimate piriform file that updates ccleaner or is it some kind of malware or virus that I should be concerned about? Thank you very much in advance for your help.