Virus detected, boot-time scan can't fix/repair/move file

[PirateGuy]

I was online browsing, when suddenly Avast detected some sort of virus, and then my computer restarted on it's own and Avast found it again and suggested a boot-time scan. While running it, it found a file on my C: drive, but can't seem to do anything with it. I'd appreciate any help I could get in removing this infection from my PC asap.

[Pondus]

what file was detected...full file path
what malware name did avast give the file?

can you attach a screenshot of the detection?

[PirateGuy]

I wasn't able to scroll up to see what the boot-time scan said, and booting back into windows is resulting in a black screen before my PC restarts. I suppose I'll try booting from my secondary Windows drive and see if Avast left some sort of log. Would that be in the Avast directory?

[Secondmineboy]

You can find the result in the Avast UI under Scan>Scan history>Detailes report.

And also in the Avast directory

[PirateGuy]

I wasn't sure which would be helpful, so I zipped all the logs that were dated as being modified today and uploaded them here: http://puu.sh/8lR2P

[Pondus]

follow instructions, attach logs from Malwarebytes / OTL / aswMBR       http://forum.avast.com/index.php?topic=53253.0

when done a malware expert will review the logs.....

[PirateGuy]

Logs:

[argus]

Hi,



Please download Farbar Recovery Scan Tool () by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
  
• Press Scan button.
  
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
  
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[PirateGuy]

Just an FYI, since I'm not able to boot into the drive with the infected Windows installation, I've been running these tools from my separate internal drive which has it's own installation of Windows, if that's important. Logs attached:

[argus]

Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:

• Type rpcss.dll into the Search: field in FRST then click the Search File(s) button.
  
• FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
  
• Please attach it to your reply.

[PirateGuy]

Log:

[argus]

1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Code: [Select]

Start
HKU\S-1-5-21-3960085472-1055159966-2924699845-1000\...\MountPoints2: {f7836af2-2892-11e3-b305-806e6f6e6963} - G:\.\Bin\ASSETUP.exe
C:\Users\Reese\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Reese\AppData\Local\Temp\_isA2B4.exe
CMD: DEL %TEMP%\*.* /F /S /Q
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.


3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
.








******************************










Please download Malwarebytes AntiRootkit (MBAR) and save it to your desktop.
For full instructions how MBAR works, read this article


> Doubleclick on the MBAR file () and allow it to run.
•  Click OK on the next screen, to allow the package to extract the contents of the file to its own folder named mbar.
•  mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.
•  After reading the Introduction, click Next if you agree.

•  On the Update Database screen, click on the Update button. Once you see 'Success: Database was successfully updated' click on Next
•  Under Scan Targets ensure all boxes are ticked. Then click the Scan button.

Notice: with some infections, you may see two messages boxes:
-  'Could not load protection driver'. Click 'OK'.
-  'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.

>>  If malware is not detected, click the Exit button to close the program and post the mbar-log-year-month-day.txt and system-log.txt reports.

>>  If an infection/s are found ensure Create Restore Point are ticked. Then select the "Cleanup! button to remove threats.
•  The clean up procedure will be scheduled for process, pop-up will be shown.
Select the Yes button and the system should re-boot to complete the cleaning process.


>>  Notice: only if an RootKit are detected, ensure to run fixdamage.exe tool located in mbar folder, \Plugins\fixdamage.exe
- Run fixdamage.exe, at the black window to continue type Y (alias for Yes). Wait few seconds for execution ...
- When you see "press any key to exit" fix is completed, press any key to close the window. Reboot the system.




> The following reports will be created in mbar folder:
1. mbar-log-year-month-day (hour-minute-second).txt
2. system-log.txt

Please post both logs in your next reply.

[PirateGuy]

Logs:

[argus]

Avast says that this file is infected

File C:\Windows\system32\rpcss.dll  **INFECTED** Win32:Malware-gen
Service DcomLaunch [C:\Windows\system32\rpcss.dll]  **HIDDEN**

But VirusTotal tells it is all clean

C:\Windows\System32\rpcss.dll
[2013-11-21 16:20] - [2010-11-20 09:27] - 0512000 ____A (Microsoft Corporation) 5C627D1B1138676C0A7AB2C2C190D123

https://www.virustotal.com/en/file/c5003f2c912c5ca990e634818d3b4fd72f871900af2948bd6c4d6400b354b401/analysis/



Describe the problem with boot windows.

[PirateGuy]

Describe the problem with boot windows.

Like I said earlier, I was online browsing when Avast popped up with a warning about some sort of virus it had detected. It seemed to have quarantined it, but then a few minutes later my PC reset suddenly, and Avast popped up again with I think the same warning, and advised a boot-time scan, which I did. During the scan, it found a infected file, but when I attempted any of the fix/repair/move options it couldn't do so. After that I canceled it to try to see what it was exactly Avast had picked up, but now the infected drive of Windows refuses to boot properly and only displays a black screen. Perhaps I just need to repair that installation?