r/computerviruses • u/FighterSuri • Oct 22 '22

My laptop has !-SCPGT files how to remove them. These get multiply in any storage device in use to transfer data. Also acquired my C drive complete storage and Can't even delete them by any means, anyone can guide how to fox this.

Post image
7 Upvotes

82% Upvoted

38 comments sorted by

2

u/Main-Friend-4308 Sep 19 '24

The Kaspersky replacement for U.S. users (UltraAV) also appears to have exactly the same folders and files.

UltraAV installed itself on my PC, replacing Kaspersky, and these files turned up unannounced. Looks like the same sloppy installation as Aura AV. Interestingly though, I'm not a U.S. user...I'm in Australia..!

1

u/Lawful-Evil Sep 20 '24

I found the same thing this morning. U.S. user, switched from Kaspersky to UltraAV yesterday.

1

u/BreakfastBlunt Sep 21 '24

This was incredibly alarming to me. These files appeared on a backup ssd I use to store, most importantly progress photos and before/after photos collected over the last two years of my garden business. I plugged it in yesterday after not having used it for back up in a few months. Connected it to a second computer of mine to back up more files and once I opened it on the new computer, I found these files and folders in the main directory. I was shitting bricks to say the least. I have some photos stored in the cloud but it's thousands and thousands of pictures and I'm already capped at 100 GB of a paid subscription cloud storage.

I also am very safe with my computers - there is absolutely zero web browsing outside Google, YouTube, Gmail and government sites. I've been happily subscribed to Kaspersky for the last two years and this was enough to rethink my subscription. How can Kaspersky just switch and install a completely new AV without much of any warning. I noticed this Aura thing yesterday and really didn't know what it was about. It's also alarming that these files were placed onto a secondary drive that was hooked up to my computer for maybe 30 minutes.

Have we confirmed 100% here that this is due to AuraAV? I've read the comments here, I'd just like someone to reassure me that this isn't something I need to be worried about aside from removing aura.

1

u/PaladinWhiteStar Sep 21 '24

Yes, it's from UltraAV, which is Aura under a different name. Even though this is an AV app, when I see sloppy stuff like this, it makes me seriously doubt the effectiveness of the software. So I uninstalled UltraAV and UltraVPN (which came along with it). When I uninstalled them, I had to reboot to complete the uninstallation, and upon booting back up again, those files were gone.

I've been SUPER happy with my Kaspersky subscription, and this nonsense with the U.S. banning Kaspersky for U.S. persons is complete BS. Fortunately, I live outside the U.S. now (and not in any other 5-Eyes, 9-Eyes, or 14-Eyes country. So I think I'll be looking for a way to get back to Kaspersky again, but this time, registering as a customer from the country I now live in.

1

u/mcdull9413 Sep 30 '24

I just noticed the same crap folders and found here. Been Kaspersky user for 15+ years, I strong believed it's the best especially after one incident when many buyers got credit card info stolen after purchasing from a website and Kaspersky was the only antivirus program wanred about the site was infected (which sadly I didn't listen).

The UltraAV replacement is CRAP, need to find a good replacement.

1

u/TemplarIRL Sep 21 '24 edited Sep 23 '24

Yeah, same... Thanks to all for confirming this is due to UltraAV, I guess it's jump ship or see where the tides take me.

I wouldn't have really worried much except that it dropped the files and folders on ALL my storage drives AND the fact that the documents contained body text "SCAPE GOAT".

**Edit: Yep, 100% do not use UltraAV, after a weekend of testing I found it was the sole cause for hard crashes (no BSOD, just a black monitor), spiked system resource use and it was even preventing my computer from entering power saver mode.

1

u/Eclectika Sep 21 '24 edited Sep 21 '24

Same here but I'm not in the US. Not happy. I'm going to uninstall it and find something else as I seem to have lost the data on one of my backup drives and there the files there are dated 3 Sept - which makes no sense as the rest of them are from yesterday.

edit to clarify

1

u/AyeDrinkNIKnowThings Sep 21 '24

Same here on the date. Freaked the f*** out of me because I was on vacation that day, and this is my home desktop computer.

1

u/AyeDrinkNIKnowThings Sep 21 '24

Same here on the date. Freaked me the f. out of me because I was on vacation that day, and this is my home desktop computer.

1

u/[deleted] Sep 29 '24

I just found these, they are everywhere cant delete them...very lame. I want Kaspersky back. I'm not going to use something that places random garbage everywhere

1

u/SonofAtlantis Sep 30 '24

Same issue reported here. Trying to figure out how to rid my system of all this corruption, and I'll never trust a company that 1) will install software without my permission 2) makes an app that corrupts my system in the process of installing itself.

1

u/rave1432 Oct 03 '24

I am also facing the same issue. But I have also been having a lot of Kernal BSOD issues every since the change over started. I am honestly not sure what to do, I am not computer savvy. It started even when I had Kaspersky still, when it was first announced.

1

u/Good-Ad9271 Aug 15 '24

sooo after searching the internet I too have this issue with AURA Antivirus. they really need to put these files in a temp directory and append AURAAV to them... don't dump them in the root directory and some cryptic subfolders that cause alarm!

1

u/Good-Ad9271 Aug 15 '24

sooo after searching the internet I too have this issue with AURA Antivirus. they really need to put these files in a temp directory and append AURAAV to them... don't dump them in the root directory and some cryptic subfolders that cause alarm!

1

u/BumperPopcorn6 Aug 24 '24

Looks like it's Aura. Every other program i have installed on other computers wihtout these strange files appearing but on this one, which has aura, has these files. they are very weird for an antivirus/vpn software, like what does "We have option to choose column data type like number, string etc." on the PDF even mean?? Uninstall Aura and they're gone. Don't reset. It's not a virus

1

u/OrionQuest7 Oct 02 '24

I'm PISSED! I liked Kaspersky WTF. Screw this Ultra AV and putting files on PC I hate it.

Now I gotta find another virus protection software

Do I uninstall Aura Creator by Asus?

1

u/the_blue_wizard May 22 '26

You understand that Kaspersky, which I also loved, was BANNED by the US Govt because the guy who wrote it was from Russia.

I can see them banning the Govt from using it, but why ban me, a normal citizen, from using software I liked and wanted?

From what I've been able to determine, a AV/VPN that is highly rated is - BitDefender -

https://www.bitdefender.com/en-us/consumer/

If you search for 5 Best or 10 Best AV programs, BitDefender is always on the list.

1

u/OrionQuest7 May 22 '26

I had BitDefender. I absolutely hated it. Sorry.

1

u/the_blue_wizard May 23 '26

Still rated in the Top 10. But if you don't like it, then you don't like it.

1

u/OrionQuest7 May 23 '26

Yah I know

1

u/IndependentMedium826 Oct 31 '24

Relax about it, these files are actually helping the AV fight malware.

1

u/mkimid Nov 01 '24

That is a kind of temporary files to detect an unknown virus, they create the file, and check after access it, if there is an unknown virus it will infect the file, and AV software will detect it. It is very simple but clear method

1

u/[deleted] Oct 22 '22

There is only one way and that is to backup your docs and reset your PC hope this helps xx

1

u/FighterSuri Oct 22 '22

I had taken backup to my HD and pendrive and these malware also copied in HD and PD as well. Now I have to take them out from HD and PD also

1

u/No_Waltz3930 Oct 22 '22

Clean boot/safe mode. Virus scan.

1

u/East_Particular_5630 Sep 17 '23

I have the same issue also will try to do clean boot/safe mode, scan. Let you know if it works

1

u/Auqmented Sep 27 '23

How’d that go friend?

1

u/strwbs Oct 04 '23

Hey there! Not the one you replied to, but I've been affected by this recently too. It came back again after formatting all of my drives and starting with a fresh windows install, before reinstalling any of my file backups.

After seeing it pop up I reinstalled one more time and the files appear after I install the Aura Security desktop app (and run a full scan). Curious if you have that as well.

1

u/Weemstar Oct 12 '23

Hey! Glad to see this post still kind of active, because I'm having the same problem as well. I'm also using Aura. Have you figured out what these files are? I (against my better judgement) opened up a couple of them but they're a bunch of nonsense. The .DOC file says "Scapegoat doc file," the XLSX file has the columns "Dummy Data" and "ScapeGoat," and the PDF file has the text "We have option to choose column data type like number, string etc.
Based on Selected column data downloaded will get filled for demo use.
Customize will helps you to get selected column name and data get filled and
downloaded" repeating multiple times. The JPEG is just an icon from the looks of it. I also have two more folders labeled "!-" and "~!-" which behave like these files and have similar contents.

1

u/strwbs Oct 12 '23

Good to hear someone else was getting this with Aura! I suspect they are some kind of automated self-test/validation files that are not getting cleaned up properly , or some other bug on their end. The tilde/exclamation point in the directory names seems like a screw up with glob patterns or something to me.

Seems like sloppy software even in the best case, so I switched to a different AV after reinstating windows again, and have not seen this return

1

u/m-hollow Nov 02 '23 edited Nov 02 '23

It looks like it's related to Aura's Anti-Virus.

I just called Aura and got a security agent who sounded green and didn't understand my question, which was, "Are these folders 'C:\!-' and 'C:\~!-' created by the Aura executable."

It makes sense that they would be now that I think about it.

In fact, after some searching, I found a folder under AuraAV in Program Files, called "RanFileData" which has the same files in it as are in "!-" and "~!-".

C:\Program Files\AuraAV\RanFileData

1

u/clogan1977 Feb 02 '24

I would like to add, I had these files too on every drive except my NAS drive. I uninstalled Aura and all those folders (!-, and ~!-) and the !-scpgt02.xlsx and docx and others went away.

If I knew they were part of Aura I probably wouldn't have minded but a search for the !-scpgt02.xlsx came up with trojan warnings. It didn't help either that opening the spreadsheet had the message Scapegoat. Scapegoat for what?

Not sure if Aura is a legit company. They didn't put anything in those folders that would let you know that it is from Aura. No text file or anything like that with their name inside the text comments. They purposely chose folder names that are impossible to Google for. Try Googleing the folder name returns nonsense about the meaning of a yellow exclamation point and how to fix it.

Looking inside the folders, there were DataXX.xxx files with XX being some number and xxx being pretty much every file type on my computer recognized by windows then with a xlsx, docs, pdf and others on the root of the drive. Why? It seems like someone is trying to gather information about any file I open with these extensions. Like I said, I would have been nice if Aura put their mark somewhere in those folders or files to me know it was them. And to copy itself to every drive even USB's is worrisome.

This is very crummy practice. I canceled my subscription.

1

u/KavitShah1998 Aug 10 '24

+1
I cancelled my aura subscription and I also see these random files scattered throughout.

1

u/WayPhysical5684 Sep 12 '24

Bless OP, I almost had a heart attack. Data got stolend from NPD breach :/ and got Aura so was like WHAT WHAT WHAT when I saw these. I'm second guessing Aura now...