Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: xSTEELCURTAINx5 on January 06, 2012, 07:03:03 AM

Title: Looking for some assistance. Safe to delete these files?
Post by: xSTEELCURTAINx5 on January 06, 2012, 07:03:03 AM

Problem solved.

Thanks everyone.

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: true indian on January 06, 2012, 07:05:42 AM

what are the name and locations of the files?

if u can tell us that we can help in deciding what will be the best for u....Please do not delete any file

we also have essexboy our malware removal expert here...so if its something serious i will give him call via PM and  he will help u out....


Happy to help!
true indian.

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: Pondus on January 06, 2012, 07:06:51 AM

Quote

What if I post a screen shot of the said list of infected files?

yes attach a screen shot

crop the pic so you dont show your hole desktop...and save as gif.....you only have 200kb

lower left corner > additional options > attach

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: xSTEELCURTAINx5 on January 06, 2012, 07:11:53 AM

Problem solved. Thanks everyone!

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: true indian on January 06, 2012, 07:15:36 AM

WARNING!do not take any actions for conserv.dll and desktop.ini files deleting or doing anything else will cause Boot failure other files can be moved to the chest u are infected with a backdoor infection.

http://forum.avast.com/index.php?topic=53253.0

follow the guide above and attach all logs..

essexboy notified...he will be here by night 8 to 11pm according to UK time.

Happy to help!
true indian.

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: xSTEELCURTAINx5 on January 06, 2012, 07:17:17 AM

Problem solved. Thanks everyone!

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: true indian on January 06, 2012, 07:18:33 AM

apart from conserv.dll and desktop.ini other files can be moved to the chest...

this is actually backdoor maxplus 90 infection..

u can also try this:
Download Dr Web from here Fill in the small form and download
http://www.freedrweb.com/download+cureit+free/?lng=en
It will download as an 8 digit file save it to your desktop
Restart in safe mode and run
Accept the enhanced version
Then run the full scan allow it to cure all infections found.
this should find and cure conserv.dll and its associates...

Happy to help!
true indian.

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: xSTEELCURTAINx5 on January 06, 2012, 08:33:46 AM

Problem solved. Thanks everyone!

Title: Re: Looking for some assistance. Safe to delete these files?
Post by: essexboy on January 06, 2012, 08:39:23 PM

Hi there would you be prepared to try out an update to aswMBR that should remove this.. ? If so run all elements in step 1.
If not then skip to step 2

Step 1

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  Quote

  :OTL
  [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc
  [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\ProgramData\m5kwoayxgy520shc
  [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin
  [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\ProgramData\v1ji23o1bs3pin
  [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776
  [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\ProgramData\6m55df0j81e776
  [2011/12/09 23:16:22 | 000,000,112 | ---- | M] () -- C:\ProgramData\8y3hx0ocM.dat
  [2011/12/09 23:16:22 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\6Figb5.com.b
  [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc
  [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\ProgramData\m5kwoayxgy520shc
  [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin
  [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\ProgramData\v1ji23o1bs3pin
  [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/09 23:16:22 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\6Figb5.com.b
  [2011/12/09 23:14:44 | 000,000,112 | ---- | C] () -- C:\ProgramData\8y3hx0ocM.dat
  [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776
  [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\ProgramData\6m55df0j81e776
  
  :Files
  ipconfig /flushdns /c
  C:\Windows\tasks\At*.job
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please delete your current copy and download this latest version

Download aswMBR.exe (http://public.avast.com/~gmerek/aswMBR.exe) ( 1.8mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 

(http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRScan.gif)

On completion of the scan click save log, save it to your desktop and post in your next reply

(http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRsavelog.gif)

Step 2

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  Quote

  :OTL
  [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc
  [2011/12/27 10:32:13 | 000,010,798 | -HS- | M] () -- C:\ProgramData\m5kwoayxgy520shc
  [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/25 23:00:13 | 000,009,058 | -HS- | M] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin
  [2011/12/22 20:35:51 | 000,008,232 | -HS- | M] () -- C:\ProgramData\v1ji23o1bs3pin
  [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/19 15:25:14 | 000,007,992 | -HS- | M] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/15 21:08:39 | 000,010,490 | -HS- | M] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776
  [2011/12/09 23:16:34 | 000,011,202 | -HS- | M] () -- C:\ProgramData\6m55df0j81e776
  [2011/12/09 23:16:22 | 000,000,112 | ---- | M] () -- C:\ProgramData\8y3hx0ocM.dat
  [2011/12/09 23:16:22 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\6Figb5.com.b
  [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\Users\Joe\AppData\Local\m5kwoayxgy520shc
  [2011/12/27 10:30:07 | 000,010,798 | -HS- | C] () -- C:\ProgramData\m5kwoayxgy520shc
  [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\Users\Joe\AppData\Local\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/25 22:58:09 | 000,009,058 | -HS- | C] () -- C:\ProgramData\vb71aqrb4gx0617eq4782oo4bp8sj5q8
  [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\Users\Joe\AppData\Local\v1ji23o1bs3pin
  [2011/12/22 20:04:03 | 000,008,232 | -HS- | C] () -- C:\ProgramData\v1ji23o1bs3pin
  [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\Users\Joe\AppData\Local\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/19 15:20:12 | 000,007,992 | -HS- | C] () -- C:\ProgramData\hxhomu2v0jat6wav2ymb8q376h6m
  [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\Users\Joe\AppData\Local\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/15 21:02:46 | 000,010,490 | -HS- | C] () -- C:\ProgramData\mtqktr4u2mpa0nks1ulk7p652q8l
  [2011/12/09 23:16:22 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\6Figb5.com.b
  [2011/12/09 23:14:44 | 000,000,112 | ---- | C] () -- C:\ProgramData\8y3hx0ocM.dat
  [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\Users\Joe\AppData\Local\6m55df0j81e776
  [2011/12/09 15:37:01 | 000,011,202 | -HS- | C] () -- C:\ProgramData\6m55df0j81e776
  
  :Files
  ipconfig /flushdns /c
  C:\Windows\tasks\At*.job
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1  (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here  (http://forums.whatthetech.com/How_Disable_your_Security_Programs_t96260.html&pid=494216#entry494216)

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

(http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png)

(http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png)

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now