Avast WEBforum
Other => Viruses and worms => Topic started by: MMR on October 05, 2012, 06:04:36 AM
-
About two days ago Avast started displaying pop up messages stating it has blocked some stuff. At first I think it was two trojan horses and some malware, but Avast got rid of the malware and now I'm just left with the trojan horses. The viruses are sirefef-a[tri] are zaccess-jc[tri] and there are in c:\recycler. Right now I'm scanning with malwarebytes and it has detected 3 thing, but I'm worried that while the scanner finishes the virus might get worse since avast is still constantly block them every 5-10 minutes. As I was typing this two malware-gen were detected so now 4 things are constantly getting blocked. Now five adding sirefef-pl [rtk] in c:\windows\assembly\gac\desktop.ini.
-
Please attach your logs. (AdwCleaner, MBAM, OTL and aswMBR..!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0
-
Sorry about not posting this first, but I was mid scan and dreaded the idea of starting all over again and waiting another three hours. Malwarebytes seems to have gotten rid of all the problems, but roguekiller may have found something. It created a quaratine folder, I'll include that report as well.
Malware Bytes Log:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Database version: v2012.10.04.11
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Owner :: OWNER [administrator]
10/5/2012 12:44:39 AM
mbam-log-2012-10-05 (00-44-39).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 228427
Time elapsed: 11 minute(s), 57 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
-
Second Half
-
Last
-
Whenever I try to look at my firewall settings I get this "Due to unidentified problem, Widows cannot display Window Firewall setting". I'm starting to think Malware Bytes didn't get it all.
-
@MMR
Hello and Wellcome to avast. ;)
- I will be working on your Malware issues this may or may not solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for this issue on this machine.
- If you don't know or understand something, please don't hesitate to ask.
- Please refrain from making any further changes to your computer (Install/Uninstall programs, delete files, edit the registry, etc...)
- Please DO NOT run any other tools or scans whilst I am helping you.
- It is important that you reply to this thread. Do not start a new topic.
- Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
- Absence of symptoms does not mean that everything is clear.
--------------------------------
> Download ComboFix from here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) and save it to your Desktop.
If you are unsure how ComboFix works please read this guide (http://www.bleepingcomputer.com/combofix/how-to-use-combofix) carefully.
note: ComboFix must be downloaded to your Desktop.
> Temporarily disable your AntiVirus program.
If you are unsure how to do this please read this (http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html) or this (http://www.bleepingcomputer.com/forums/topic114351.html) Instruction.
How to disable avast:
- Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
- In the window that opens on the top right corner, click Settings.
- In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
- Right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
- In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn on this option after the cleaning.
> Run ComboFix. Click on I Agree!
ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix's window while it is running.
If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart computer once more.
> When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.
-
Heres the ComboFix.txt. Thanks for taking the time to help me out, I really appreciate it. It did not ask me if I wanted to install Recovery Console, but I'm guessing thats because it is already installed.
-
Hi MMR, ;)
Multiple Antivirus Programs
You are running more than 1 Antivirus program!
AV: avast! Antivirus *Disabled/Updated*
AV: Microsoft Security Essentials *Disabled/Updated*
Running - more than one - antivirus program is not recommended because:[list=1]
- They can conflict with each other.
- Report the other antivirus software as malicious.
- Antivirus programs use an enormous amount of computer's resources... actively scanning your computer.
- Can cause your computer to become unstable...run slowly and even, in rare cases, BSOD crash...etc
I strongly suggest you uninstall one of them. Which one, is your decision.
----------------------
Step#1
Download TDSSKiller (http://support.kaspersky.com/downloads/utils/tdsskiller.exe) and save it to your desktop
Execute TDSSKiller.exe by doubleclicking on it.
- Press Start Scan
- If Suspicious object is detected, the default action will be Skip, click on Continue.
- If Malicious objects are found, select Cure.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt
Please post the contents of that log in your next reply.
*********************
Step#2
Open notepad and copy/paste the text present inside the code box below:
File::
c:\program files\Common Files\akafyzo.exe
ClearJavaCache::
Save this as CFScript.txt
(http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif)
Close all browser windows and refering to the picture above.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )
-
TDSSKiller Log.
-
ComboFix.txt
-
>I still see that there is a two AV present.
By disabling it one AV, does not mean you've solved the problem.
I still recommend that you remove one, but your will, your computer.
- Disable AV, delete current copy and download fresh Combofix.exe. We will use new, fresh one.
Open notepad and copy/paste the text present inside the code box below:
File::
c:\windows\pss\MyWebSearch Email Plugin.lnkStartup
c:\program files\Common Files\akafyzo.exe
KillAll::
Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
DDS::
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
Save this as CFScript.txt
(http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif)
Close all browser windows and refering to the picture above.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )
-
I can not seem to find Microsoft Security Essentials. I have looked on my start up list, change/remove programs and c:\program Files, but cannot find any traces of it. Please let me know how to locate it so I can remove it.
-
Ok, run this tool to remove MSE
Fix it (http://go.microsoft.com/?linkid=9748340)
Then run Combofix via CFScript ;)
-
I did what you said in the last post, but could not find the combofix log, so I ran it again and got some error message telling to continue, cancel or abort, I think. Sorry for the screw up.
-
I did what you said in the last post, but could not find the combofix log, so I ran it again and got some error message telling to continue, cancel or abort, I think. Sorry for the screw up.
Did I understand correctly ...
When you run Combofix, during scanning with Combofix you got that error?
Ok, restart your computer, then delete current copy of Combofix and download fresh one. Create CFScript and re-run Combofix.
-
I restarted my computer, then deleted current copy of Combofix and download fresh one. Create CFScript and re-run Combofix. Then when I could not find the log I redid it all over again ang got the error. It worked fine the first time I just could not the log so I tried it again.
-
Please download zoek.exe (http://home.kpn.nl/stefsmeenk/zoek.exe/) and save it to your desktop.
- Close any open browsers.
- Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this (http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html) or this (http://www.bleepingcomputer.com/forums/topic114351.html) Instruction.
- Double click on zoek.exe to run the tool .
Please wait while the tool does not start...
- Select "Combined fix"options (http://fotkica.com/thumbs3/1_tmb_149978192_zoek.jpg) (http://fotkica.com/slike.php?slika=1_149978192_zoek.jpg) (bottom right)
- Copy the text present inside the code box below and paste it into the large window in the zoek tool:
filesrcm;
startupall;
MyWebSearch;z
- Click on Run script button
Please wait until a logreport will open (this can be after reboot)
- Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named "zoek-results.log"
******************
> Try just to re-run Combofix without using CFScript, see if that works?
*****************
> Re-run OTL, click on RunScan button and attach here fresh OTL.txt log
-
Sorry for the delay, here are all the logs.
-
@MMR
If I don't respond to you within 24 hours, please refresh/bump your topic.
-
@MMR
First lets check posible AV leftovers...
Download AppRemover (http://www.appremover.com/) (~ 6MB) on Desktop .
Run it by double-clicking
(http://www.spywareinfoforum.com/public/style_emoticons/default/excl.gif) unchecki Enable anonymous usage statistic
Click Next, choose the second option (Clean Up a Failed Uninstall), confirm with Continue, go to Next, wait to be finished, choose any antivirus leftovers if shows , scan and remove it by clicking on the Next .
***************************
> How's your computer running now?
-
AppRemover did not find anything and my computer is running fine.
-
Nice... 8)
It is necessary to uninstall ComboFix :
- Click Start (or (http://amf.mycity.rs/pg/images/VistaStartButton.png)) then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
- In the line of text type in (Copy) the following:
ComboFix /Uninstall Note that there is a space between " ComboFix " and " /Uninstall " .
- then click OK (or press Enter ).
Wait for the uninstall process is complete.
--------------------
> Re-run OTL and click on CleanUp! button.
You will be asked to reboot the machine to finish the cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTL. Feel free to manually delete any tools it leaves behind.