SandBox malfunction possibly virus

[CAS159]

Sandbox was not activated on the avast_free_antivirus_setup.exe 86k application.  I could not do an online setup without a loss in dial-up connection.  I could not go to version 9 online so I uninstalled Avast 8 after downloading Version 9.  Previous post I was advised to upgrade as the Sandbox was running on its' own.  I'd like to send you my Explorer.exe file.  I think that's were the bug lives.  What do I know?  I just did an Explorer.exe search and its' still going so I captured it.

[Pondus]

I'd like to send you my Explorer.exe file.  I think that's were the bug lives.  What do I know?

if bug means you think it is infected?
upload and test suspicious files here  www.virustotal.com / www.metascan-online.com / www.jotti.org

[CAS159]

Explorer came up negative for Virustotal. "Metascan-online found a threat" under the Antiy engine. All others were negative.  I inverted metascan-online capture because it was hard to read.  Jotti came up negative.

[essexboy]

To me that looks clean, I can check it for you but I do not feel I will find anything

 Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[CAS159]

Combofix first download was corrupted under my Dial-up so I downloaded again.  On the re-boot I had to shut down Malwarebytes, Outpost firewall. Avast, and the clock.  When ComblFix first loaded I forgot my Avast.txt file which contains passwords and Session notes.  So I closed it before Stage10.  I checked my pictures sub-directory and it is still missing files.  I have to use explorer to find out if it will crash my system with an error message.  Can I do a CheckDisk or anything else to recover that data?  I read with a cyclic redundancy check (23) there are procedures to recover sectors. 

[CAS159]

I'd like to send you my Explorer.exe file.  I think that's were the bug lives.  What do I know?

if bug means you think it is infected?
upload and test suspicious files here  www.virustotal.com / www.metascan-online.com / www.jotti.org

 
The only virus checker online that found a problem with Explorer was Antiy.net on Metascan-online.  So I went to their site and found "Virus Submit Tools submit samples online".  It didn't work and I went to CNET to rate Antiy.net and stumbled across a report stating that Mozilla FireFox dropped Trojan add ons.  Antiy is first package Antiy-AVL FireFox recommends to cleanup your computer affected by the Add On's, Avast is second. 

http://download.cnet.com/8301-2007_4-10448331-12.html
"Mozilla recommends that users who suspect that they are infected use one of the following security applications to sweep and clean their computers after uninstalling the threatening add-on:
Antiy-AVL
Avast
AVG
GData
Ikarus
K7 AntiVirus
McAfee
Norman
VBA32
Infected users should note that only Avast and AVG are free."

I just finished an search for the Trojan Add On's with negative results.
Nothing to do but Check Disk and get some sleep.

[CAS159]

Check disk brought back the directory.  It took 3 hours.  I think I try Mozilla FireFox forum about the Trojan Add On's.

[essexboy]

Explorer was clean.  A missing system file was replaced but that was all 

[CAS159]

My system has been freezing up.  When I came home from work Friday morning my Earthlink dial-up connection was froze and I could not do anything else.  There were no error messages so I rebooted.  Firefox was up with 14 tabs open, 6 notepad files, 2 Sumatra PDF files, Windows picture and Fax Viewer, and Snagit screen capture program. 
Saturday morning i had 17 FireFox tabs open but set to work offline.  The system was slow to respond to commands.  There was no error message.  Other programs up were the same as before.
I rebooted and when I got up this afternoon I searched for remnants of Trojan.Spy.Agent,
Win32.Bifrose.32.Bifrose,,and Win32.LdPinch.gen.  Trojan.Spy.Agent was found by MalwareBytes, Win32.Bifrose.32.Bifrose with Sothink Web Video Downloader 4.0, and Win32.LdPinch.gen with Master Filer.  According to Mozilla:
 "Master Filer was removed from Mozilla's Firefox add-on site on January 25, and the Sothink video downloader was removed on Tuesday. CNET Download.com ceased hosting the Sothink add-on on Friday before noon.

Sothink Web Video Download 5.5.90819 had been a mildly popular Firefox add-on at Download.com, receiving 697 downloads in the past week and 63,716 downloads since it was first added to the site in June 2007.

Because the Trojan horse programs are tied to Firefox, Mozilla warns, host computers won't be infected until Firefox started. Uninstalling either add-on is only part of the solution, if the infection has already attacked the host computer. Mozilla recommends that users who suspect that they are infected use one of the following security applications to sweep and clean their computers after uninstalling the threatening add-on:

Antiy-AVL
Avast
AVG
GData
Ikarus
K7 AntiVirus
McAfee
Norman
VBA32

Infected users should note that only Avast and AVG are free."

According to Mozilla Avast is supposed to be able to correct any problems on my computer left from these FireFox Add-ons.   

[essexboy]

Did you run Browser cleanup utility

[CAS159]

I just ran Browser Cleanup Utility.  I'm going to set conditions as before to test it.

[Pondus]

Antiy-AVL
Avast
AVG
GData
Ikarus
K7 AntiVirus
McAfee
Norman
VBA32

Infected users should note that only Avast and AVG are free."

Just some info.....the above is not completely correct .....Norman link goes to there Malware cleaner tool that is FREE

That does not mean you should run it....follow Essexboys advice   

[CAS159]

I went out for over two hours and my system woke up from standby mode right away.  I guess the browser cleanup fixed it.  Maybe that was it all along since only one system file needed replacement.  MalwareBytes did find 14 problems when I installed it, 2 or which were malware.
MalwareBytes takes 160,360Kb + 6,384Kb to run in two processes compared to Avast 40,960Kb + 6,880 in two in my Task Manager.  I would think Avast would take that much memory instead of MalwareBytes?

[CAS159]

My problem returned with screen freezes, fake standby re-boots, mouse pointer (circle with four arrows from radius) moving or scrolling up the Firefox screen(see attachment of close pointer match).  i ran malwarebytes with negative results, and SFC /scannow is almost finished.  I"m looking for an online virus scanner for an independent look.  It always happens when I try to wake up from standby.

[REDACTED]

have you tried    iexplore.exe