Author Topic: Avast constantly blocking trojan horse over and over again  (Read 15846 times)

0 Members and 1 Guest are viewing this topic.

MMR

  • Guest
Avast constantly blocking trojan horse over and over again
« on: October 05, 2012, 06:04:36 AM »
About two days ago Avast started displaying pop up messages stating it has blocked some stuff. At first I think it was two trojan horses and some malware, but Avast got rid of the malware and now I'm just left with the trojan horses. The viruses are sirefef-a[tri] are zaccess-jc[tri] and there are in c:\recycler. Right now I'm scanning with malwarebytes and it has detected 3 thing, but I'm worried that while the scanner finishes the virus might get worse since avast is still constantly block them every 5-10 minutes. As I was typing this two malware-gen were detected so now 4 things are constantly getting blocked. Now five adding sirefef-pl [rtk] in c:\windows\assembly\gac\desktop.ini.
« Last Edit: October 05, 2012, 06:16:55 AM by MMR »

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Avast constantly blocking trojan horse over and over again
« Reply #1 on: October 05, 2012, 07:35:51 AM »
Please attach your logs. (AdwCleaner, MBAM, OTL and aswMBR..!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

MMR

  • Guest
Re: Avast constantly blocking trojan horse over and over again
« Reply #2 on: October 05, 2012, 11:03:50 PM »
Sorry about not posting this first, but I was mid scan and dreaded the idea of starting all over again and waiting another three hours. Malwarebytes seems to have gotten rid of all the problems, but roguekiller may have found something. It created a quaratine folder, I'll  include that report as well.

Malware Bytes Log:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.10.04.11

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Owner :: OWNER [administrator]

10/5/2012 12:44:39 AM
mbam-log-2012-10-05 (00-44-39).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 228427
Time elapsed: 11 minute(s), 57 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

MMR

  • Guest
Re: Avast constantly blocking trojan horse over and over again
« Reply #3 on: October 05, 2012, 11:09:12 PM »
Second Half

MMR

  • Guest
Re: Avast constantly blocking trojan horse over and over again
« Reply #4 on: October 05, 2012, 11:10:48 PM »
Last

MMR

  • Guest
Re: Avast constantly blocking trojan horse over and over again
« Reply #5 on: October 06, 2012, 12:04:41 AM »
Whenever I try to look at my firewall settings I get this "Due to unidentified problem, Widows cannot display Window Firewall setting". I'm starting to think Malware Bytes didn't get it all.

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Avast constantly blocking trojan horse over and over again
« Reply #6 on: October 06, 2012, 01:53:36 PM »
@MMR
Hello and Wellcome to avast.  ;)
  • I will be working on your Malware issues this may or may not solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • If you don't know or understand something, please don't hesitate to ask.
  • Please refrain from making any further changes to your computer (Install/Uninstall programs, delete files, edit the registry, etc...)
  • Please DO NOT run any other tools or scans whilst I am helping you.
  • It is important that you reply to this thread. Do not start a new topic.
  • Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
  • Absence of symptoms does not mean that everything is clear.
--------------------------------



> Download ComboFix from here and save it to your Desktop.
If you are unsure how ComboFix works please read this guide carefully.
note: ComboFix must be downloaded to your Desktop.

> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this or this Instruction.

How to disable avast:

  • Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
  • In the window that opens on the top right corner, click Settings.
  • In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.

  • Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
  • In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.



> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.

ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.

If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.


> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
  Attach log reports ( ComboFix.txt) back to topic.


MMR

  • Guest
Re: Avast constantly blocking trojan horse over and over again
« Reply #7 on: October 06, 2012, 11:07:08 PM »
Heres the ComboFix.txt. Thanks for taking the time to help me out, I really appreciate it. It did not ask me if I wanted to install Recovery Console, but I'm guessing thats because it is already installed.

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Avast constantly blocking trojan horse over and over again
« Reply #8 on: October 07, 2012, 04:47:02 PM »
    Hi MMR, ;)




    Multiple Antivirus Programs

    You are running more than 1 Antivirus program!


    AV: avast! Antivirus *Disabled/Updated*
    AV: Microsoft Security Essentials *Disabled/Updated*


    Running - more than one - antivirus program is not recommended because:[list=1]
    • They can conflict with each other.
    • Report the other antivirus software as malicious.
    • Antivirus programs use an enormous amount of computer's resources... actively scanning your computer.
    • Can cause your computer to become unstable...run slowly and even, in rare cases, BSOD crash...etc
    I strongly suggest you uninstall one of them.  Which one, is your decision.

    ----------------------
     Step#1 


    Download TDSSKiller  and save it to your desktop

        Execute TDSSKiller.exe by doubleclicking on it.

    •     Press Start Scan

       
    •   If Suspicious object is detected, the default action will be Skip, click on Continue.
       
    •   If Malicious objects are found, select Cure.
    Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt


    Please post the contents of that log in your next reply.

    *********************
     Step#2 

    Open notepad and copy/paste the text present inside the code box below:


    Code: [Select]

    File::
    c:\program files\Common Files\akafyzo.exe

    ClearJavaCache::




    Save this as CFScript.txt



    Close all browser windows and refering to the picture above.

    Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    ComboFix will will re-run. When finished, it will produce a log for you.
    Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )

    MMR

    • Guest
    Re: Avast constantly blocking trojan horse over and over again
    « Reply #9 on: October 08, 2012, 12:06:50 AM »
    TDSSKiller Log.

    MMR

    • Guest
    Re: Avast constantly blocking trojan horse over and over again
    « Reply #10 on: October 08, 2012, 12:36:19 AM »
    ComboFix.txt

    Offline magna86

    • Anti Malware Fighter
    • Avast Evangelist
    • Massive Poster
    • ***
    • Posts: 4235
      • Ambulanta MyCity Forum - ASAP Member
    Re: Avast constantly blocking trojan horse over and over again
    « Reply #11 on: October 08, 2012, 03:10:27 PM »
    >I still see that there is a two AV present.
    By disabling it one AV, does not mean you've solved the problem.
    I still recommend that you remove one, but your will, your computer.


    - Disable AV, delete current copy and download fresh Combofix.exe. We will use new, fresh one.
    Open notepad and copy/paste the text present inside the code box below:


    Code: [Select]

    File::
    c:\windows\pss\MyWebSearch Email Plugin.lnkStartup
    c:\program files\Common Files\akafyzo.exe

    KillAll::

    Registry::
    [-HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]

    DDS::
    Trusted Zone: clonewarsadventures.com
    Trusted Zone: freerealms.com
    Trusted Zone: soe.com
    Trusted Zone: sony.com





    Save this as CFScript.txt



    Close all browser windows and refering to the picture above.

    Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    ComboFix will will re-run. When finished, it will produce a log for you.
    Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )

    MMR

    • Guest
    Re: Avast constantly blocking trojan horse over and over again
    « Reply #12 on: October 08, 2012, 10:44:21 PM »
    I can not seem to find Microsoft Security Essentials. I have looked on my start up list, change/remove programs and c:\program Files, but cannot find any traces of it. Please let me know how to locate it so I can remove it.

    Offline magna86

    • Anti Malware Fighter
    • Avast Evangelist
    • Massive Poster
    • ***
    • Posts: 4235
      • Ambulanta MyCity Forum - ASAP Member
    Re: Avast constantly blocking trojan horse over and over again
    « Reply #13 on: October 09, 2012, 01:52:25 PM »
    Ok, run this tool to remove MSE

    Fix it




    Then run Combofix via CFScript  ;)

    MMR

    • Guest
    Re: Avast constantly blocking trojan horse over and over again
    « Reply #14 on: October 11, 2012, 04:38:15 PM »
    I did what you said in the last post, but could not find the combofix log, so I ran it again and got some error message telling to continue, cancel or abort, I think. Sorry for the screw up.