« previous next »
Pages: 1 [2] 3   Go Down

Author Topic: Win32 Injector Infection  (Read 13589 times)

0 Members and 1 Guest are viewing this topic.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #15 on: March 09, 2013, 10:12:04 PM »
OK lets start with OTL initially

Download OTL  to your Desktop
Secondary link
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.


  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
BASESERVICES
%SYSTEMDRIVE%\*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
winsock.*
/md5stop
CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Post  both logs
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #16 on: March 09, 2013, 11:31:31 PM »
posted
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #17 on: March 09, 2013, 11:49:07 PM »
The logs look nice and clean .. Are you experiencing any problems ?
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #18 on: March 10, 2013, 12:26:35 AM »
I've just noticed the laptop being real slow no matter what I'm doing on it.  Other then that I haven't seen any other problems.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #19 on: March 10, 2013, 12:35:52 PM »
Clear Cache/Temp Files
Download TFC by OldTimer to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.  Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #20 on: March 10, 2013, 09:42:34 PM »
I scanned the file again today like you asked of me and the result still read "MCSysUtil.dll   Win32:Injector - AZQ [Trj]".  I also ran the program TFC, so I'll let you know if I start noticing a difference in my system.  Thanks for your assistance as usual, essexboy.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #21 on: March 10, 2013, 09:50:19 PM »
OK lets see where that file is

  • Run OTL.


  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
/md5start
MCSysUtil.* 
/md5stop
CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Post  both logs
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #22 on: March 10, 2013, 10:41:06 PM »
posted
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #23 on: March 10, 2013, 11:00:55 PM »
Intriguing, what location does Avast say it is in ?
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #24 on: March 10, 2013, 11:08:10 PM »
"C:\WINDOWS\system32" for Original Location.
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #25 on: March 10, 2013, 11:13:12 PM »
Is it in the chest now ?
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #26 on: March 10, 2013, 11:19:26 PM »
Yes sir.  At first it told me it couldn't be moved to the chest, deleted, or fixed, but later when I opened Avast I found it in there. 
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Win32 Injector Infection
« Reply #27 on: March 10, 2013, 11:29:50 PM »
Leave it there for now and check it again in a bout a weeks time

Although metamail appears to be a Linux programme
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #28 on: March 12, 2013, 02:14:27 AM »
I'll let you know, essexboy.
Logged

demontosome26

  • Guest
Re: Win32 Injector Infection
« Reply #29 on: March 16, 2013, 05:23:29 PM »
I ran a scan on the file today and it came back with "MCSysUtil -no virus-".  I'm assuming that means it's safe, so should I restore the file?
Logged
Pages: 1 [2] 3   Go Up
« previous next »