Win32\Malware-gen

[donfriesen]

An 'Avast free' scan revealed the Win32 Malware-gen virus in the d: colorcpl exe. Any help to remove would be greatly appreciated. Thanks.

[Pondus]

upload colorcpl exe to www.virustotal.com and test with 40+ malware scanners
post link to scan result here when done


Malware removers are notified. It may take hours before one arrive so be patient

also run AdwCleaner and post log   

[polonus]

See: http://www.faultwire.com/file_report/colorcpl.exe.html

polonus

[Pondus]

What is the "colorcpl.exe" ?
http://systemexplorer.net/file-database/file/colorcpl-exe
http://www.processchecker.com/file/colorcpl.exe.html

there is also this  http://support.microsoft.com/kb/2643719

MS12-012: Vulnerability in Color Control Panel could allow remote code execution: February 14, 2012

[magna86]

@ donfriesen
Hello and welcome to avast!. I reviewed posted logs and I don't see active malware in it.
----------------------------------------------------------------------------

Code: [Select]

AutoRun File - [ ... ] - D:\Autorun.inf

I recommendet to check USB storage devices / removable drives if you will.

---   ---   ---   ---

• Download MCShield from one of the following links:
  

MyCity -  Official download link
Softpedija - Mirror download link

• Double click MCShield-Setup to install the application.
  
• Wait a few seconds to MCShield finish initial scan.

Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.

• Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.

When all scanning is done, you need to attach a logreport that has made MCShield.

Start -> All Programs -> MCShield -> Logs

Attach here -> AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

***********************


 Please download TFC by OldTimer to your desktop.
- Temporaly disable malwarebytes.

• Please double-click TFC.exe to run it. (Note: If you are running on Vista and above, right-click on the file and choose Run As Administrator).
  
• It will close all programs when run, so make sure you have saved all your work before you begin.
  
• Click the Start button to begin the process. Depending on how often you clean temp
  files, execution time should be anywhere from a few seconds to a minute
  or two. Let it run uninterrupted to completion.
  
• Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.

*****************

• Download AdwCleaner (by Xplode) on your desktop.
  
• Launch it, click on [Search] and wait for the scan.
  
• When the scan ends, notepad with the report will appears.
• Click on the [Delete] Wait for the programme completes his work.
  The program will close all active programs. Click OK to confirm that.
  On the next two windows that open ( Informations and Restart required ) click OK
  
• The computer will restart and open a notepad ( C:\AdwCleaner[S1].txt ) with the report.
• Save the notepad report on the Desktop
• Please attach here C:\AdwCleaner[S1].txt

Note: The report will also be stored on C:\AdwCleaner[S1].txt [/list]

***************************

> Re-run OTL and click on CleanUp! button.

You will be asked to reboot the machine to finish the cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTL. Feel free to manually delete any tools it leaves behind.




**************************
I also recommendet to run some leght registry cleaner ( as CCleaner for example if you will ).

[donfriesen]

upload colorcpl exe to www.virustotal.com and test with 40+ malware scanners
post link to scan result here when done


Malware removers are notified. It may take hours before one arrive so be patient

also run AdwCleaner and post log   

Pondus reply#1   The Avast scan revealed the virus to be in the D recovery partition. I can't access this and I also don't know how to upload this file to the website you  requested.

Here is the adw Cleaner log:

# AdwCleaner v2.105 - Logfile created 01/13/2013 at 18:27:32
# Updated 08/01/2013 by Xplode
# Operating system : Windows Vista (TM) Home Basic Service Pack 2 (32 bits)
# User : Don dec15 - DON-PC
# Boot Mode : Normal
# Running from : C:\Users\Don dec15\Downloads\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v18.0 (en-US)

File : C:\Users\ducky\AppData\Roaming\Mozilla\Firefox\Profiles\1btrr2wm.default-1351037531189\prefs.js

[OK] File is clean.

File : C:\Users\ducky\AppData\Roaming\Mozilla\Firefox\Profiles\ok0czt2u.default\prefs.js

[OK] File is clean.

File : C:\Users\Don dec15\AppData\Roaming\Mozilla\Firefox\Profiles\0r2t9cwv.default-1357513048235\prefs.js

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1132 octets] - [13/01/2013 00:02:34]
AdwCleaner[R2].txt - [1004 octets] - [13/01/2013 18:27:32]
AdwCleaner[S1].txt - [7178 octets] - [12/01/2013 12:56:01]

########## EOF - C:\AdwCleaner[R2].txt - [1124 octets] ##########

[donfriesen]

See: http://www.faultwire.com/file_report/colorcpl.exe.html

polonus

Polonus reply#2:  Thanks for your interest in this thread, and also for the info in the link you provided. Don

[magna86]

donfriesen, just reset your system restore ( turn off and then turn on ).

[donfriesen]

donfriesen, just reset your system restore ( turn off and then turn on ).

Thanks Magna86 reply 7  I'll do that. What response should I expect from this action?

[donfriesen]

upload colorcpl exe to www.virustotal.com and test with 40+ malware scanners
post link to scan result here when done


Malware removers are notified. It may take hours before one arrive so be patient

also run AdwCleaner and post log   

Pondus reply 1:  Thanks for the quick response. I've tried twice to reply to your replies, working for over an hour each time and then having my responses disappear in the wind (obviously I'm very frustrated).

My 'Avast free' virsu scan showed the Win32\Malware-gen to be in the d drive ( my system restore files). I can't access the colourcpl.exe file in this location, but I did  a 'Virus Total' scan of this colorcpl.exe  from C drive location and the result was: no virus.  Can I safely assume that the file in the D drive  is also virus free?

[magna86]

donfriesen, just reset your system restore ( turn off and then turn on ).

Thanks Magna86 reply 7  I'll do that. What response should I expect from this action?

Response is that detection should not occur anymore.

Detections is AV heuristics related. And as i wrote above, your system is clean, there is no malware, so just reset your system restore ( turn of and than turn on ) system restore tool will delete old restore points ( ald old created "image" files), and after that AV should no longer display any future warnings.

[donfriesen]

donfriesen, just reset your system restore ( turn off and then turn on ).

Thanks Magna86 reply 7  I'll do that. What response should I expect from this action?

Response is that detection should not occur anymore.

Magna86 reply 10    Thanks so much for all your help!  Don

Detections is AV heuristics related. And as i wrote above, your system is clean, there is no malware, so just reset your system restore ( turn of and than turn on ) system restore tool will delete old restore points ( ald old created "image" files), and after that AV should no longer display any future warnings.

[donfriesen]

To all concerned:

This problem has been solved. According to the response from Magna86 I presume I had a false positive detection. Thanks to Magna86, Pondus, and Polonus for your interest and help. Don.