Malwear bites detected 48 malwear

[noriko_sh]

Hi, I have been using avast premium paid one, and done full virus scan and boot time scan constantly.
Yesterday, for the first time, I installed Malwear bites and conducted scanning. 48 malwear was detected.
Does that mean, Avast virus scan can not detect malwear???
What should I do now??

[mchain]

Attach the scan log from Malwarebytes with 48 detections in your next reply.

[noriko_sh]

Some parts are Japanese because my app is in Japanese. So, I translated as much as I can.

Malwarebytes
www.malwarebytes.com

-ログの詳細-(Details of Log)
スキャン日付: 2018/04/24 (Scan date)
スキャン時間: 15:00
ログファイル: 5b09fc64-477c-11e8-a742-184f32499ebc.json (Log file)
管理者: はい

-ソフトウェア情報- (Software info)
バージョン: 3.4.5.2467(Version)
コンポーネントバージョン: 1.0.342 (compornent version)
パッケージバージョンをアップデート: 1.0.4852 (package version was updated)
ライセンス: トライアル版 (License: trial)

-システム情報- (system)
OS: Windows 10 (Build 16299.371)
CPU: x64
ファイルシステム: NTFS (file system)
ユーザー: DESKTOP-2UCKNVE\norik

-スキャン結果の概要- scan result
スキャンタイプ: 脅威のスキャン threatning scan
スキャン開始日時: マニュアル start date
結果: 完了 completed
スキャンされたオブジェクト: 297042 scaned objects
検出された脅威: 48 detected threats
隔離された脅威: 48 put away threats
経過時間: 3 分 53 秒 duration

-スキャンオプション-
メモリ: 有効 memory : on
スタートアップ: 有効 start up:on
ファイルシステム: 有効 file system:on
アーカイブ: 有効 arkive : on
ルートキット: 無効 ruitekit on
ヒューリスティック: 有効 hyuristic on
PUP: 検出 detected
PUM: 検出 detected

-スキャンの詳細- scan detail
プロセス: 0 process
(悪意のあるアイテムは検出されませんでした)

モジュール: 0 module
(悪意のあるアイテムは検出されませんでした)

レジストリキー: 12 registrie key
PUP.Optional.InstallCore, HKU\S-1-5-21-1813046565-785978577-4226810915-1001\SOFTWARE\csastats, 隔離済み, [386], [260986],1.0.4852
PUP.Optional.WebDiscoverBrowser, HKU\S-1-5-21-1813046565-785978577-4226810915-1001\SOFTWARE\WebDiscoverBrowser, 隔離済み, [1579], [253912],1.0.4852
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\OLOJCNAGMCBPLPDDDABMPFEHHLLEOBPB, 隔離済み, [241], [509543],1.0.4852
PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\OLOJCNAGMCBPLPDDDABMPFEHHLLEOBPB, 隔離済み, [241], [509543],1.0.4852
PUP.Optional.SearchManager, HKU\S-1-5-21-1813046565-785978577-4226810915-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\olojcnagmcbplpdddabmpfehhlleobpb, 隔離済み, [241], [509543],1.0.4852
PUP.Optional.WebDiscoverBrowser, HKLM\SOFTWARE\WebDiscoverBrowser, 隔離済み, [1579], [253915],1.0.4852
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\12laboursofhercules3-wt.exe, 隔離済み, [6699], [248811],1.0.4852
PUP.Optional.WebDiscoverBrowser, HKLM\SOFTWARE\WOW6432NODE\WebDiscoverBrowser, 隔離済み, [1579], [253915],1.0.4852
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TEAMVIEWER.EXE, 隔離済み, [7314], [239351],1.0.4852
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\12laboursofhercules3-wt.exe, 隔離済み, [6699], [248811],1.0.4852
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TEAMVIEWER.EXE, 隔離済み, [7314], [239351],1.0.4852
PUP.Optional.WinYahoo, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{0AF3E233-5A73-33B3-EBF3-43333B7390B3}, 隔離済み, [244], [302717],1.0.4852

レジストリ値: 4 registry value
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\12laboursofhercules3-wt.exe|DEBUGGER, 隔離済み, [6699], [248811],1.0.4852
PUP.Optional.IFEO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TEAMVIEWER.EXE|DEBUGGER, 隔離済み, [7314], [239351],1.0.4852
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\12laboursofhercules3-wt.exe|DEBUGGER, 隔離済み, [6699], [248811],1.0.4852
PUP.Optional.IFEO, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\TEAMVIEWER.EXE|DEBUGGER, 隔離済み, [7314], [239351],1.0.4852

レジストリデータ: 0 registry data
(悪意のあるアイテムは検出されませんでした)

データストリーム: 0 data streem
(悪意のあるアイテムは検出されませんでした)

フォルダ: 7 folder
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data\Crashpad\reports, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data\Crashpad, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\WINDOWS\SYSWOW64\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\WEBDISCOVERBROWSER, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.Webbar, C:\PROGRAM FILES\WEBDISCOVERBROWSER, 隔離済み, [1576], [348279],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\USERS\NORIK\APPDATA\LOCAL\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}, 隔離済み, [244], [302717],1.0.4852

ファイル: 25  file
PUP.Optional.Booking, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\BOOKING.COM.LNK, 隔離済み, [741], [347183],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data\Crashpad\metadata, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data\Crashpad\settings.dat, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data\CrashpadMetrics-active.pma, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.WebDiscoverBrowser, C:\Windows\SysWOW64\config\systemprofile\AppData\Local\WebDiscoverBrowser\User Data\CrashpadMetrics.pma, 隔離済み, [1579], [444086],1.0.4852
PUP.Optional.Webbar, C:\Program Files\WebDiscoverBrowser\unins000.exe, 隔離済み, [1576], [348279],1.0.4852
PUP.Optional.SearchManager, C:\USERS\NORIK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, 置き換え済み, [241], [509543],1.0.4852
PUP.Optional.WinYahoo, C:\PROGRAMDATA\Microsoft\Windows\Start Menu\Programs\HowToRemove.lnk, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\USERS\NORIK\APPDATA\LOCAL\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HOWTOREMOVE\HOWTOREMOVE.HTML, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\chromium-min.jpg, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\control panel-min-min.JPG, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\down.png, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\ff menu.JPG, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\ff search engine-min.png, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\hp-min ff.png, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\hp-min ie.png, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\search engine.gif, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\setup pages.gif, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\sp-min.png, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\start-min.jpg, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\HowToRemove\up.png, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\midaretot, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.WinYahoo, C:\Users\norik\AppData\Local\{F64AC016-D2E2-ACAE-BF7A-89469B1275DE}\uninst.exe, 隔離済み, [244], [302717],1.0.4852
PUP.Optional.GBoxApp, C:\USERS\NORIK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\SyncData.sqlite3, 置き換え済み, [280], [455242],1.0.4852
PUP.Optional.GBoxApp, C:\USERS\NORIK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, 置き換え済み, [280], [455242],1.0.4852

物理セクタ: 0 objective sectore
(悪意のあるアイテムは検出されませんでした)


(end)

[Pondus]

Does that mean, Avast virus scan can not detect malwear???

Malware = Malicious software / a name that covers ALL malicious programs (virus / trojans / worms ....... )

Some parts are Japanese because my app is in Japanese. So, I translated as much as I can.

Not necessary as all detections and locations will be in english

Malwarebytes detected PUP = Possible Unwanted Program (some want it others dont) usually bundled crap programs
https://www.howtogeek.com/232791/pups-explained-what-is-a-potentially-unwanted-program/
https://support.malwarebytes.com/docs/DOC-1121
https://www.malwarebytes.com/pup/
For info you can search detection name here  >>  https://blog.malwarebytes.com/threats/


When Malwarebytes detect it list evry location/trace of that detection so it looks as it detected many, other security software may only list it as one detection

avast consentrate on detecting malicious programs but also PUP if you have selected PUP detection in avast?

and done full virus scan and boot time scan constantly.

Boot time scan is not meant to be used as a regular scanner and it does not give any better detection
Your avast have realtime protection, meaning EVRYTHING that goes on in your computer when it is on is scanned in realtime

[Michael (alan1998)]

Building into Pondus and Mchain here. MBAM detected mostly pup but you did have trace IFEOs in there. They could be nothing but just to make sure run FRST scans as well and post the log.

Instructions : https://forum.avast.com/index.php?topic=194892.0

Edit - I fixed my phones hilarious autocorrects. I hope you don't have OREO's in your computer.. might destroy the hardware 

[noriko_sh]

I have attached and sent the logs two days ago.
Any up date?

[Pondus]

I have attached and sent the logs two days ago.
Any up date?

Update on what?     

There is no attachment here only a copy paste, and the questions in your first post has been answered

[mchain]

See below:

[noriko_sh]

I was suggested by Michael (alan 1998) to run FRST and send the logs. I have done so, but I will do attache the logs again.
Please check them and let me know if it is safe to use my PC or not.
If not, please let me know what I should do to make it safe.
Thank you.

[Sass Drake]

MBAM cleaned up almost all potentially unwanted software but now:

• Open Notepad (click Start button -> type notepad.exe -> press Enter)
• Copy text from code block below and paste it into Notepad

Code: [Select]

S3 iscFlash; \??\C:\Users\norik\AppData\Local\Temp\7zSF754.tmp\iscflashx64.sys [X] <==== ATTENTION
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\API portfoli:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\Avenues pay slip etc:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\CSU Human Nutrition:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\hp.applications.package.appdata:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\hp.system.package.metadata:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\Japanese teaching materials:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\job search:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\Keen constrution:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\Moxa therapy:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\Naturopathy:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\OLA payslip:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\Taxi income:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\vectore assignment:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\レシピ:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\住所録 メールアドレス:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\学校関係:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\手紙:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
AlternateDataStreams: C:\Users\norik\OneDrive\Documents\日記:${3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0}.Metadata [194]
EmptyTemp:

• Go to File -> Save As
• Make sure that  UTF-8 is selected as Encoding (left side of Save button)
• Save it as fixlist.txt on Desktop
• Open again FRST and click on button Fix
• Wait until FRST finishes
• fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

[noriko_sh]

Hi Drake,
Please see the attachement of fixlog
Thank you.

[Sass Drake]

What is system status now?

[noriko_sh]

How do I know the system status?

I have just posted to the Japanese site, but I got an error essage from Avast

UI Failed to load
This is really embarrassing
AV service is not resiponding

EXIT/RESTART

I restarted but nothing has changed.
I rung up Avast customer support, and they said I have to pay $112 to fix this problem.

Is there any way I could fix this problem without paying

[Sass Drake]

That was not Avast support. Try to reinstall Avast.

[noriko_sh]

I had not other choice as I had to use the pc, so I paid $112 and what they did was that they deleted some anti virus softwears that was left on the registry. When I bought my PC, MaCafee was pre-instoled. And, when I got Avast, I  uninstoled the soft by using controle panel.
But, according to a guy from Avast, there were some parts left on my registry, and it was causing this problem.
And, to clean this and some other un wanted softwears, I had to pay $112.
He said, if I do not pay and fix this problem, I will not be able to use Avast safely.

This is the site I got this phone number:
https://support.avast.com/en-au
and the number was:
1800 875 178

I am in Australia. So, this number is for Australia.

Do you think, this site is a scam?
It is said, this is the official Avast Site.