Avast WEBforum

Other => Viruses and worms => Topic started by: Lib on July 29, 2011, 09:32:19 AM

Title: "A threat has been detected"
Post by: Lib on July 29, 2011, 09:32:19 AM
Hello all,

Well, the title of this thread is roughly how I would translate this message that has kept popping up on my Avast for the past few days (I am a European French-speaker, hence Avast is set up in French here :-p)

The threat in question seems to be malware (a "malicious url address") and/or a trojan horse, depending on the moment.

I have followed the advice given in the top thread of this section, i.e. I have downloaded Malwarebytes and made a full scan (after the quick scan had found nothing).

Two suspicious elements were found, which I promptly deleted.

Unfortunately, the warning message has kept coming back, so I have performed a second full scan and once again deleted the suspicious elements.

After this I have downloaded OTS, scanned my PC with it and downloaded the log (should I post it here?).

Needless to say that the "threat" keeps coming back...I even received 14 such messages consecutively at one point..

As I use this computer mainly for work, any help from you would be greatly appreciated (please bear in mind that I am not exactly a tech or computer-savvy person...so if you could keep your explanations somewhat simple and detailed, I would be doubly grateful to you :-))

Thanks in advance!
Title: Re: "A threat has been detected"
Post by: Gargamel360 on July 29, 2011, 09:35:06 AM
Quote from: Lib on July 29, 2011, 09:32:19 AM
After this I have downloaded OTS, scanned my PC with it and downloaded the log (should I post it here?).
Yes, this is the place to post it.  Use the attachment function (see "additional options" when you are making a post).
Title: Re: "A threat has been detected"
Post by: Lib on July 29, 2011, 10:13:19 AM
Thank you for your response, Gargamel.

Things are becoming even more fun in the meantime.

I made a new scan with OTS in order to have a fresh new log, but when I wanted to save the log in my appropriately created OTS file, the ANSI format was unavaliable (the box is just blank).

And when I open the OTS file or try to upload my log on here, the log doesn't appear! The folder is empty, as if I hadn't saved anything at all (which I guarantee I did...I even re-made a OTS scan, deleted the previous logs, saved it in several locations...but to no avail...the log get saved...but doesn't exist :-s..
Title: Re: "A threat has been detected"
Post by: Pondus on July 29, 2011, 11:00:54 AM
Delete
Title: Re: "A threat has been detected"
Post by: Lib on July 29, 2011, 11:14:51 AM
Hi Pondus,

Not sure whether that is an advice or whether you've deleted your own post..

If you mean that I should delete the OTS logs, I have. At least it seems so since the folder is empty when I open it...

Too bad it isn't when I try to save a new OTS log in said folder (in that case the previous logs do appear!)..

Basically I cannot delete OTS logs that otherwise appear invisible, and when I save new ones, they become invisible too.

All very confusing...and Avast's malware warnings keep popping up :-p
Title: Re: "A threat has been detected"
Post by: Pondus on July 29, 2011, 11:24:03 AM
it was just me not reading your first post good enough, so i deleted the txt  

anyway it will be some time before essexboy is here...he is the OTS expert
he is usually in here at 08:00pm - 11:59pm uk time  


have you tried to run a boot time scan with avast first ?
if it find and remove anything, then try OTS again...could be some new malware that is blocking OTS


OBS: you should also post the log from Malwarebytes scan, so Essexboy can see what was found/removed


Title: Re: "A threat has been detected"
Post by: Lib on July 29, 2011, 11:43:20 AM
Thank you Pondus.

Well it seems that I can at least have access to and post the Malawarebytes log, so in the meantime here it is.

Regards,

Lib
Title: Re: "A threat has been detected"
Post by: Pondus on July 29, 2011, 11:52:42 AM
your malwarebytes was not updated when you did the scan..
your database: 7257  Latest database: 7315

MBAM can have 10 updates on a day, so always hit the update button before you start scanning

so update scan again, post new log if anything is found/removed
Title: Re: "A threat has been detected"
Post by: Lib on July 29, 2011, 12:12:17 PM
Ok thanks I will do that.

Incidentally, I also have Ad-Aware on my computer from way back...is there a risk of conflict between the latter and Malwarebytes? if so, should I unisntall Ad-Aware?

Thanks in advance.
Title: Re: "A threat has been detected"
Post by: Lib on July 29, 2011, 12:43:19 PM
Ok so I've updated Malawarebytes and done a quick scan. Two more elements were found (trojans). Attached is the log.

Avast on the other hand didn't find anything, once again...and lo and behold, I've just had my first "threat detected" :-p..
Title: Re: "A threat has been detected"
Post by: essexboy on July 29, 2011, 06:59:37 PM
Hi there lets using a different variant then - this will download as a screensaver  ;D so if you use firefox then right click the link and select save as - do not let Avast sandbox this programme, run it normally - Attach the logs to your next post please 

Download OTL (http://oldtimer.geekstogo.com/OTL.scr)  to your Desktop
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT


Title: Re: "A threat has been detected"
Post by: Lib on July 30, 2011, 01:03:58 AM
Hello Essexboy,

Thank you for your reply.

I don't use Firefox and I didn't seem to find any link...HOWEVER this morning I am able again to download the log in ANSI format AND see it appear in its folder. So hereafter it is.

Looking forward to your precious help,

Lib
Title: Re: "A threat has been detected"
Post by: essexboy on July 30, 2011, 01:19:52 PM
OK not a lot showing there so I will empty your temp files and check the MBR first

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Code: [Select]

[Unregister Dlls]
[Custom Items]
:Files
ipconfig /flushdns /c
:end
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix.  Post that information back here

I will review the information when it comes back in.

Depending on what the fix contains, this process may take some time and your desktop icons might disappear or other uncommon behavior may occur.

This is no sign of malfunction, do not panic!

THEN

Download aswMBR.exe (http://public.avast.com/~gmerek/aswMBR.exe) ( 1.8mb ) to your desktop.
 
Double click the aswMBR.exe to run it
 
Click the "Scan" button to start scan
 (http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR2-1.gif)
 
On completion of the scan click save log, save it to your desktop and post in your next reply
(http://public.avast.com/~gmerek/aswMBR2.png)
Title: Re: "A threat has been detected"
Post by: Lib on July 30, 2011, 02:38:14 PM
Hello Essexboy,

I have performed the run fix with OTS as you recommended. After a (somewhat long) while, I received a message saying that OTS had stopped working.

I turned off my computer and upon turning it on again this log (attached) opened up automatically.

Before I proceed with the next step, could you tell me if said log is of any use to you? If not, should I retry the scan fix before downloading aswMBR?

Thanks in advance.
Title: Re: "A threat has been detected"
Post by: essexboy on July 30, 2011, 07:17:12 PM
You had a multitude of temporary files on your system - this was why it appeared to stall

Lets run another quicker programme to clear the temps and then run aswMBR

Clear Cache/Temp Files
Download TFC by OldTimer (http://oldtimer.geekstogo.com/TFC.exe) to your desktop
Title: Re: "A threat has been detected"
Post by: Lib on July 31, 2011, 01:24:24 AM
Good morning Essexboy,

I've performed the TFC scan as well as the aswMBR one.

Attached is the log relating to the latter.

I am looking forward to further useful guidance from you.

Lib
Title: Re: "A threat has been detected"
Post by: essexboy on July 31, 2011, 11:36:04 AM
Are you still getting the alerts ?

Download ComboFix from one of these locations:


Link 1 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 2 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)


* IMPORTANT !!! Save ComboFix.exe to your Desktop


When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.
Title: Re: "A threat has been detected"
Post by: Lib on July 31, 2011, 02:10:43 PM
Well I have been on the computer all day and I haven't received any alert...except for one, when I visited this particular website (a football forum :-p) and was told that a trojan had been blocked. I already received this message systematically in the past few days whenever I visited that page.

But other than that, no alert whatsoever so far...does this mean that the possibility of a trojan still exists, albeit remote, or that the problem lies with that website and that I should simply not visit it anymore?
Title: Re: "A threat has been detected"
Post by: essexboy on July 31, 2011, 02:29:17 PM
To me that suggests the website has been hacked

No need to run combofix - but let me know tomorrow if there are any further problems

If not I will remove my tools
Title: Re: "A threat has been detected"
Post by: Lib on August 01, 2011, 06:01:48 AM
Hello essexboy,

So far I haven't had any problem today either. The only alert since the clean-up, as I said, was yesterday when I visited that site. So I guess I'll just stay away from it for some time.

Again thank you very much for your help.
Title: Re: "A threat has been detected"
Post by: essexboy on August 01, 2011, 07:45:00 PM
Subject to no further problems   :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Start OTS. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

Code: [Select]

[Unregister Dlls]
[Custom Items]
:Files
ipconfig /flushdns /c
:end
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]

Uninstall ComboFix

Remove Combofix now that we're done with it.
Run OTS and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

(http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif)   Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

SPRING CLEAN

To manually create a new Restore Point

Now we can purge the infected ones

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
 
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif) Malwarebytes (http://www.malwarebytes.org/mbam-download.php).  Update and run weekly to keep your system clean

Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)
Keep safe  :wave:
Title: Re: "A threat has been detected"
Post by: Lib on August 07, 2011, 05:30:01 AM
Ok, I have performed the run fix and uninstalled the older versions of Java (I had not installed ComboFix), and I have made the spring clean.

I will run Malawarebytes weekly and will install FileHippo too.

Cheers,

Lib