Help with my Malware virus scan logs, please

[melissajkelly]

I looked for this report, but do not have a "Report" folder in the Avast folder, and do not have this .txt file in any of the Avast folders.

      C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt

I searched the PC for "aswBoot.txt" and it said the file was not found.  Should I be looking for a different file?  I am running avast! Free Antivirus on a W7 64 bit machine and definitions were just updated this morning.

Thanks!

[magna86]

Hm...
Logs looks good. I don't see nafting bad here. Re-run avast! boot time scan once more. When avast finish scanning, try to find there and attach here aswBoot.txt logreport.

[melissajkelly]

I ran an avast! boot scan and asked it to DELETE files that it finds (because in the past that was the only way it would "find" the virus I mentioned in my first message---when Windows would warn me that it was a Windows .dll file and ask me to confirm I wanted to delete it).  This time, it went on past that and booted into Windows.  And the log then revealed that it found a virus in Hotmail and moved it to the chest.  (See attached .jpg)

I am convinced there is some kind of virus on this machine but I don't know how to find it.

I **still** do not have that sub-folder under the avast folder, and do not have the text file you are asking for anywhere on my system.  If I'm using the free version of Avast should I still have that file??  I don't understand why I don't.  Thanks!

[magna86]

This detection is not active malware, file is detected with antivirus heruistics. Nothing to worry about, FP (false positive) simply must happen from time to time.
Detected file is related for Windows Live Messenger.


As I wrote above, all your logs are clean and no active malware here... 
---------------


> First let's remove some registry remains and do some speed up of your PC.

Re-run OTL.exe.

• Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.
  
  

Code: [Select]


:Otl
CHR - Extension: Ask Toolbar = C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaandgknhidclennijgnchhaiefkmch\7.15.4.24146_0\
O3 - HKU\S-1-5-21-3172663602-4032253925-2754547789-1000\..\Toolbar\WebBrowser: (no name) - {ADCA5064-9E30-43FE-9856-58B07A3149FE} - No CLSID value found.

:Commands
[CREATERESTOREPOINT]
[emptytemp]



• Then click the Run Fix button at the top.
  
• Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. You don't need to attach that log.

- - - - - - -

Then you may remove/uninstall OTL tool:

Re-run OTL and click on CleanUp! button.

You will be asked to reboot the machine to finish the cleanup process, choose Yes.
After the reboot all the tools we used should be gone.
Note: Some more recently created tools may not yet be removed by OTL. Feel free to manually delete any tools it leaves behind.



-----------------



I recommended you to keep Malwarebytes on your system and to add MCShield tool if you will.

You may download MCShield from one of the following links:

MyCity -  Official download link
Softpedija - Mirror download link

It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
And not only will prevent infection, but it will immediately clean flash drive, memory card or external HDD.

[melissajkelly]

Thanks. I ran the custom fix as you suggested.  I will follow the remaining steps.

I assume, then, that Avast and Malwarebytes can be on the machine simultaneously without a problem?  And McShield, too?

Thanks for your help.  I will continue to run boot scans and regular scans, because I still don't understand why I got that first message about the .dll file naming the virus. 

[magna86]

Hi,

I assume, then, that Avast and Malwarebytes can be on the machine simultaneously without a problem?  And McShield, too?

Yes. avast! is antivirus and Malwarebytes and MCShield are antimalware tools. Watch them like a great support to your current antivirus program.

I will continue to run boot scans and regular scans, because I still don't understand why I got that first message about the .dll file naming the virus.

Boot time scanning is good thing when you do have some active malware detected on the system. Otherwise, scanning from the active system is enough.

Take another look at the picture you're attach. See the detected file path?
%appdata%\local\Microsoft\WindowsLiveMessanger

As I wrote above, detection is false. It's not a malicious software nothing to worry about. You may put that detected file to ignore list.

[melissajkelly]

Thanks.  Yes, I realize that file wasn't a problem.  My concern was over the virus found during the boot scan a few days ago, which started this thread:

The other day when my Avast! Free Antivirus ran a boot scan, with "delete" selected, and the computer warned me that a virus was found in a Windows file and asked me to confirm deletion.  The message said "... wininet .dll is infected by Win32 malwar –gen" and I Googled the virus name.