C:/Fauxvirus/carny_ride.exe... what on earth is that?

Question

I was watching my Norton Scan, since I had nothing better to do, and I noticed where it came up with a folder in my c drive known as "fauxvirus" with an executable file named carny_ride or carnyride. Anybody heard of this yet? I looked on the internet, but the only thing I could find was a website that had no idea what it was and two websites in Chinese... I know some Japanese, but not Chinese, so that definitely didn't help :P But yes... It doesn't show up, even after "showing hidden folders". So I can't locate the file(s), it won't show up in my directories, and I am pretty sure that it didn't recognize it as a threat. I use Norton 2007 internet security.

Answer 1

Best Answer - Chosen by Asker

'Spysheriff'-
Go to Control Panel>Add/Remove Programs> look for spysheriff- remove if found-if not, OK.

Now:
Make all hidden system files visible like this-and then delete all TEMP. files (leave files visible until the end)
http://www.literateletter.com/xpstep5.ht…

Now:
Download, install, UPDATE the programs listed below. These are free programs with free removals and free definition updates.
--
Always click the button to UPDATE before starting the scan.
Remove (Quarantine) all items they find. before scanning and removing anything-
--
Boot into Safe Mode- for the best chance of success.
(see link below)
http://www.pchell.com/support/safemode.s…
--
Scan immediately with #1.
1. SuperAntispyware here:
http://www.superantispyware.com

Run scan and remove items found-
reboot into Normal mode...

Download these for a later time...
These two are free, make a great pair and work well together, when used one after the other...
2. Ad-Aware 2007 here:
http://www.lavasoft.com/products/ad_awar…
3. SpyBot Search & Destory here:
http://www.safer-networking.org

Go to C:\>Program files>
remove these folders if found:
1. SpySheriff
2. Fauxvirus\carny_ride.exe (this detection may be sitting in your 'Volume\_restore' folder where nothing can delete it. Another reason you can't see it. We will address that with the restore procedure below-

Follow up by-
From the browser menu, go to Tools>Internet Options>Browsing history>delete button>
then delete your Temporary Internet Files and your Cookies.

Next-
To delete all the restore points on your computer, disable and re-enable System Restore on the system. Click Start, Control Panel, and then the System icon. Click on the System Restore tab in the dialog box, select the Turn off System Restore check box, and click Apply.
Reboot computer.
Clear the check box again to re-enable System Restore and then click OK.

Now run a full anti-virus scan and anti-spyware scans with one or two of the scanners suggested...

Any problems left?
If yes, post additional info. to question-

If no, go back and hide all system files- (reverse instruction in above link)

Hope this helped.
---

Use protection,
your computer will thank you.

Asker's Rating:

Asker's Comment:

I think this helped, but then again, I wouldn't really know since I could really see it in the first place :P If I find that it didn't, I'll try doing the things that everyone else has suggested.

Answer 2

Are you virus definition files up to date? I tried looking for this one on the net, but likewise, couldn't find any pages in English.

Try doing a scan here using the latest virus database: http://housecall.trendmicro.com/

Answer 3

DEFINITION OF: CARNY_RIDE.EXE
Safety Rating: Known Malware, do not run
Malware Family: Part of Malware group - Rootkit Haxdoor
Malware Form: EXPLOIT

http://spywarefiles.prevx.com/spywarefil…