Avast WEBforum
Other => Viruses and worms => Topic started by: Quinten1 on December 24, 2013, 10:53:58 AM
-
Hi, I keep getting Avast alerts and have tried running about 10 different malware and spyware removal programs but they don't seem to have helped.
The alerts are becoming more frequent even though the programs I run don't seem to pick up anything.
Any help would be greatly appreciated :)
I have since followed all the instructions given in the viruses and worms section, here are my logs:
-
Remover Notified.
-
Deleted by OP
-
Hi,
Please download zoek.zip or zoek.rar by smeenk ((http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png)) from here (http://hijackthis.nl/smeenk) or here (http://home.kpn.nl/stefsmeenk/zoek.exe) and save it to your Desktop.
Unpack the archive...
- Close any open browsers
- Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this (http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html) or this (http://www.bleepingcomputer.com/forums/topic114351.html) Instruction.
- Double click on zoek.exe to run the tool .
Please wait while the tool does not start...
- Copy the text present inside the code box below and paste it into the large window in the zoek tool:
Uninstall-List;
{2318C2B1-4965-11D4-9B18-009027A5CD4F};C
AutoClean;
C:\Windows\SysNative\*.tmp;F
C:\Users\Quin\Documents\*.tmp;F
FilesRCM;- Click on (http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png) button.
Please wait until a logreport will open (this can be after reboot)
- Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named "zoek-results.log"
-
Hi
Thanks for the help..
Really appreciate it :)
Here is the log from zoek
-
Hi,
This looks good. Zoek has been clean up your computer from craps...
Re-run zoek as you did before but use this script for running:
EmptyFoldersCheck;
EmptyCLSID;
FFDefaults;
CHRDefaults;
ipconfig /flushdns >> %temp%\log.txt;b
EmptyAllTemp;
AutoClean;
When zoek completes and ask for reboot allow him and then post me fresh created zoek log.
Tell me is malware URL warning quieted?
-
Thanks :)
I am still getting a lot of alerts about URL: Mal
Here is the new log.
-
Hm ... in that case I'll need to look an deeper. Also, screenshot of alert would be fine to.
Please download Farbar Recovery Scan Tool (http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/) ((http://www.mcshield.net/personal/magna86/Images/FRST_canned.png)) by Farbar and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
- Double-click to run it. When the tool opens click Yes to disclaimer.
- Under Optional Scan ensure "Driver MD5" are ticked.
- Press Scan button.
- It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
- The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Next ...
Please download GMER, the RootKit Detector tool from the link below and save it to your Desktop:
Gmer download link (http://www2.gmer.net/download.php)
Note: file will be random named
Double-clicking to run GMER.
- Wait for initial scan to finish - if there is any query, click No;
- Click [ Scan ] button and wait until the full scan is complete;
- Click [ Save ... ]- save the report to the Desktop (named ARK );
- Then click the >>> button and select Autostart card;
- Click [ Scan ] button;
- After quick scan, click Copy button;
- Open notepad and Paste text. Save report to the Desktop (named autostart )
> Attach here both Gmer logreports. (ARK.txt and autostart.txt)
-
Hi,
Here are all the logs and a screenshot..
Thanks again for all the help :)
-
forgot to add this one
-
Hi,
Looks like that avast flags the uTorrent (ex BitTorrent) or it's download progress.
Regarding the rest of the analysis, well they are interesting. GMER shows posible malware presence. I do not mean abaut GMER's "RootKit" warnings as these driver files are avast related, but GMER does tells me that we certainly requires additional checks as it has been detected some suspicious behavior.
FRSTScripts shall preform some more info + remove some leftovers and bad files. Therefore we shall deploy ComboFix as I would like to see what CF will tell us.
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Start
File: C:\Windows\system32\ntoskrnl.exe
File: C:\Users\Quin\AppData\Roaming\uTorrent\uTorrent.exe
File: C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_59849.sys
File: C:\Windows\system32\DllHost.exe
CMD: ipconfig /flushdns
C:\Users\Quin\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj
CHR Extension: () - C:\Users\Quin\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj\1.7_0
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
MountPoints2: {9165b7c8-befa-11e2-aa26-d43d7e4e58c5} - G:\setup.exe
AlternateDataStreams: C:\Users\Quin\Documents\daenerys.eml:OECustomProperty
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
Next ....
1. Please download ComboFix by sUBs from here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) and save it to your Desktop.
If you are unsure how ComboFix works please read this guide (http://www.bleepingcomputer.com/combofix/how-to-use-combofix) carefully.
Note: ComboFix must be downloaded to your Desktop.
--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this (http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html) or this (http://www.bleepingcomputer.com/forums/topic114351.html) Instruction.
Instructions how to disable avast:
- Right click on the avast! system tray icon ((http://www.mcshield.net/pg/images/avast5.png)) in the lower right corner of the screen and scroll up to avast! shield controls;
- In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.
--------------------------------------------------------------------
3. Run ComboFix. Click on I Agree!
- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.
--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt )
Attach log reports ( ComboFix.txt) back to topic.
Re-check
Re-run FRST, just hit Scan button (non addition options is needed) and post me fresh FRST.txt logreport.
-
Cool :)
That doesn't sound too bad then?
Here are all the logs.
-
Ok, this logs does looks satisfying. :)
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Start
U3 kxldipog; \??\C:\Users\Quin\AppData\Local\Temp\kxldipog.sys [x]
C:\Users\Quin\AppData\Local\Temp\kxldipog.sys
CMD: DEL %TEMP%\*.* /F /S /Q
CMD: RD /S /Q %TEMP%
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please copy-paste it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
-
Ok, I have rerun FRST with the new fixlist you sent me, here is the log
-
Looks good. How is your computer behavior?
-
Still getting alerts like this one
-
Should I try removing and reinstalling uTorrent to see if that helps?
-
Yes, that alerts ...
Well, as avast reports the uTorrent or some torrent in download progress, you'll have to see what's going on, whether it's good or if avast triggers on the application itself. If so, put it in exclusion.
You are malware (http://en.wikipedia.org/wiki/Malware) free. Posted logs are now appear cleans and show no signs of active infection.
Good workman always cleans up after himself.
• The following will implement some post-cleanup procedures:
It is necessary to uninstall ComboFix :
- Click Start (or (http://amf.mycity.rs/pg/images/VistaStartButton.png)) then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
- In the line of text type in (Copy) the following:
ComboFix /Uninstall Note that there is a space between " ComboFix " and " /Uninstall " .
- then click OK (or press Enter ).
Wait for the uninstall process is complete.
=> Please download DelFix (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/9-delfix) by Xplode to your Desktop.
Run the tool and check the following boxes below;
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Remove disinfection tools
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Create registry backup
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
--- --- --- --- --- --- --- --- --- --- ---
• To help AntiVirus to protect your computer and speed it up, I recommend that you download, install and keep the following free programs:
1. Keep Malwarebytes Anti-Malware (http://www.malwarebytes.org/mbam-download.php), update it regularly or from time to time and run a Quick Scan weekly.
Malwarebytes will detect and remove all traces of known malware. MBAM isn't AntiVirus and it can NOT replace it.
2. Keep MCShield Anti-Malware (http://www.mcshield.net/downloads.html), the tool will be updated regularly and perform auto-checking for malware to each attached USB memory device.
MCShield, has been designed as a lightweight scanner that's smart enough to catch even new worms and work in fully automatic removal mode.
3. It’s recommended to delete Temporary Files every once in a while. Run the tool and click on the Start button and TFC will begin to clean. Then restart the computer.
Temp File Cleaner aka TFC by OldTimer (http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/)
TFC is small & usefull utility that shall clean up temp files from all userprofiles and system folders.
--- --- --- --- --- --- --- --- --- --- ---
• How to protect yourself?
- I recommend that you use one of the fantastic opportunities provided by (http://www.mcshield.net/pg/images/avast5.png) avast! 2014.
1. Adjust avast! to target PUP (http://computersecurity.wikia.com/wiki/Potentially_unwanted_program) software:
Run avast! 2014 by clicking the system tray icon in the lower right corner of the screen.
Click on Settings, in the new window that opens, click on Active Protection, then under File System Shield click on gear wheel...
Under Sensitivity part of option check box for Scan for potentialy unwanted programs PUP.
2. avast! Software Updater. Run avast!, click on Tools > Software Updater.
For security reasons, make sure you do update your browser(s), Java, Flash Player, and basically every software you use often.
3. avast! Browser Cleanup. Run avast!, click on Tools > BrowserCleanup.
Browser Cleanup tool is an integrated tool in avast! AV that allows you the control on browsers unwanted addons.
4. avast! Malware Scan. Run avast!, click on Scan and preform QuickScan by clicking on Start button.
Every once in a whilere, it's recommended to preform virus scan with avast! 2014.
- Windows Updates, beeing up to date is very important. Please be sure to activate automatic updates in your control panel.
Widnows XP (http://support.microsoft.com/kb/306525); Windows Vista (http://windows.microsoft.com/en-US/windows-vista/Understanding-Windows-automatic-updating); Windows 7 (http://windows.microsoft.com/en-US/windows7/Understanding-Windows-automatic-updating) and Windows 8 (http://windows.microsoft.com/en-us/windows-8/windows-update-faq)
-
Ok
Thanks so much for all the help :)