Avast WEBforum

Other => Viruses and worms => Topic started by: njwhitworth on May 15, 2014, 08:57:37 PM

Title: Win32:Malware-gen
Post by: njwhitworth on May 15, 2014, 08:57:37 PM
Hello,

My system is infected with Win32:Malware-gen and I have followed the instructions at http://forum.avast.com/index.php?topic=53253.0

Please see the attached log files.

Thanks
Nick
Title: Re: Win32:Malware-gen
Post by: njwhitworth on May 15, 2014, 09:32:33 PM
Here's the last log file.

Thanks in advance

Nick
Title: Re: Win32:Malware-gen
Post by: magna86 on May 15, 2014, 09:33:22 PM
Hi,




Please download zoek.zip or zoek.rar by smeenk ((http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png)) from here (http://hijackthis.nl/smeenk) or here (http://home.kpn.nl/stefsmeenk/zoek.exe) and save it to your Desktop.
Unpack the archive...
Code: [Select]
EmptyCLSID;
CHRDefaults;
FFDefaults;
AutoClean;THEN ...





1. Please download ComboFix by sUBs ((http://www.mcshield.net/personal/magna86/Images/IconComboFix.png)) from here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) and save it to your Desktop.
If you are unsure how ComboFix works, read this guide (http://www.bleepingcomputer.com/combofix/how-to-use-combofix).

--------------------------------------------------------------------
2. Temporarily disable your AntiVirus program, usually via a right click on the System Tray icon. They may interfere with Combofix.
If you are unsure how to do this please read this (http://www.techsupportforum.com/forums/f50/how-to-disable-your-security-applications-490111.html) or this (http://www.bleepingcomputer.com/forums/topic114351.html) Instruction.

Instructions how to disable avast:
• Right click on the avast! system tray icon ((http://www.mcshield.net/pg/images/avast5.png)) in the lower right corner of the screen and scroll up to avast! shield controls;
• In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note:  Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.

--------------------------------------------------------------------
3. Run ComboFix. Then, on disclaimer window, click I Agree! button.

- ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
-If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
- ComboFix will scan your computer in stages, total of 50 stages.
Do not mouse-click around while ComboFix is running.
- If malware is detected, ComboFix will begin with its removal, and may need to restart Windows.
Note:If you see a message like "Illegal operation attempted on a registry key that has been marked for deletion" just restart your computer.

--------------------------------------------------------------------
4. When the tool is finished, it will produce a log report for you. (typical location: C:\ComboFix.txt)
=> Attach log report (ComboFix.txt) back to topic.

ComboFix shall also create addition log (typical location: C:\Qoobox\ComboFix-quarantined-files.txt)
=> Please attach that report (ComboFix-quarantined-files.txt) as well.
Title: Re: Win32:Malware-gen
Post by: njwhitworth on May 18, 2014, 10:45:17 AM
Hi,

I tried to run the Zoek tool but no code box appeared.  All that happened was a pop up appeared which said my system would reboot within a minute.  I couldn't find any log files either.

I ran ComboFix and the results are attached.

Thanks
Nick
Title: Re: Win32:Malware-gen
Post by: magna86 on May 18, 2014, 08:42:13 PM
Hi,


Could you please delete the zoek tool and download the fresh one from the links above and try to re-run zoek but this time with this zoekscript:

Code: [Select]
QuickScan;
Zoek shall preform the diagnostic and create the zoek log (C:\zoek-results.log). Please post that log here...
Title: Re: Win32:Malware-gen
Post by: njwhitworth on May 19, 2014, 05:38:20 PM
Hi,

Downloaded the tool again and same thing happens - no application window opens and PC reboots.  NO log file to be found.

Regards
Nick
Title: Re: Win32:Malware-gen
Post by: magna86 on May 19, 2014, 06:17:51 PM
Hi,

Could you please try to run this zoek script? Then, when zoek finish his scan to post me his created log...

Code: [Select]
FilesRCM;
StartUpAll;
FirefoxLook;
ChromeLook;
Btw, you need to be patient with zoek ... run the tool ... wait to be loaded... paste & run script ...wait for him to finish his scan.
Title: Re: Win32:Malware-gen
Post by: njwhitworth on May 19, 2014, 06:20:48 PM
How can I run the script? When I double click zoek.exe my PC reboots.
Title: Re: Win32:Malware-gen
Post by: magna86 on May 19, 2014, 06:24:39 PM
Huh . . then just post me the fresh OTL log. QuickScan will do.
Title: Re: Win32:Malware-gen
Post by: njwhitworth on May 19, 2014, 07:37:50 PM
Here it is.

Thanks
Title: Re: Win32:Malware-gen
Post by: magna86 on May 19, 2014, 08:28:12 PM
These set of logs are clean. There is no malicious activity.
Recommendation to reset all your browser back on their defaults. You can apply that action via their settings. Use google to find out how.


• The following will implement some post-cleanup procedures:

=> Please download DelFix (http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/9-delfix) by Xplode to your Desktop.

Run the tool and check the following boxes below;
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Remove disinfection tools
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Create registry backup
(http://www.mcshield.net/personal/magna86/Images/checkmark.png) Purge System Restore
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.






Cheers
Title: Re: Win32:Malware-gen
Post by: njwhitworth on May 20, 2014, 02:39:19 PM
Great, thank you very much for your help, it's much appreciated:-)
Title: Re: Win32:Malware-gen
Post by: magna86 on May 20, 2014, 02:49:41 PM
 ;)