Author Topic: Avast got owned! Shame shame  (Read 3130 times)

0 Members and 2 Guests are viewing this topic.

cruzadas

  • Guest
Avast got owned! Shame shame
« on: December 31, 2006, 10:34:27 PM »
Ok, now this is really freaking me out. I think avast got itself infected.

Here's the story, I opened an .exe file (containing virus) and sudently, my avast stopped running. The tray icon disappeared as well. I rebooted. At windows start up avast runs, but closes instantly. I decided to start windows in safe mode, but I ouldn't do it, because computer rebooted itself automatically while loading components.

When I try to run avast, an error occurs and an window pops up asking me to send the error to the avast team.

I tried to uninstall avast in the add/remove programs, but although it appears in the list, it seems like it's already uninstalled, because when I click on it, it starts the installation setup (!).

So now I ran Panda ActiveScan, it found some spywares and 1 file with a virus. It's the .exe file I opened and that started all this issues. Virus name is Mitglieder.LX. Panda detected what avast didn't. File is deleted now, but problems remain present of course. I don't know what this virus did to me, but I'm guessing it deleted some useful system files.

Needless to say I won't trust avast anymore after this one.
« Last Edit: December 31, 2006, 10:37:34 PM by cruzadas »

Offline oldman

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4142
  • Some days..... MOS...this bug's for you

galooma

  • Guest
Re: Avast got owned! Shame shame
« Reply #2 on: January 01, 2007, 01:40:19 AM »
more info here http://www.symantec.com/security_response/writeup.jsp?docid=2004-060716-2359-99

What you have or had may be a new variant but if Panda caught it then thats less likely.
If your system is now compromised then disable /turn off when your not using it as its probably generating spam remotely.

If you need help beyond the removal instructions recommended then post back.
good luck :)

cruzadas

  • Guest
Re: Avast got owned! Shame shame
« Reply #3 on: January 01, 2007, 03:17:02 AM »
Thanks Cloussau.

Unfortunately I don't think that's the same one. The one Panda caught was named Trj/Mitglieder.LX and I really don't know exactly what it does. http://antivirus.hispavista.com/virus_143029_mitglieder-lx

What I can tell is that I'm going to format my computer. Damn! I already repaired windows, but it didn't work.

What's happening is at least this: Windows won't allow me to install Anti-virus of any kind. Even SP2 security center doesn't show the "anti-virus" tab, seems like it was removed. My computer is now an open door.

Safe mode doesn't work in any way. I already tried to disable some sys files from booting that could be responsible for a conflict, but it didn't work either. It'll start only in normal mode, and the welcome message takes ages to load. Finally when I logon, a handful of kernel error start to show up.
« Last Edit: January 01, 2007, 03:21:13 AM by cruzadas »

mauserme

  • Guest
Re: Avast got owned! Shame shame
« Reply #4 on: January 01, 2007, 06:49:11 AM »
What you have or had may be a new variant ...
First detected by Panda on 29 Dec 06 so yes, pretty new.  Additional info can be found here

http://www.pandasoftware.com/com/virus_info/encyclopedia/overview.aspx?lst=vis&idvirus=143029&sitepanda=particulares

Cruzadas, according to Panda one of the symptoms is a rather non-specific "displays false error messages when it runs", so don't rush into a reformat.

You could try this to boot into safe mode:

> Click Start, Run and type MSCONFIG in the box and click OK
> The System Configuration Utility appears, On the BOOT.INI tab, Check the "/SAFEBOOT" option, and then click OK and Restart your computer when prompted.
> When you're finished open MSCONFIG again, on the BOOT.INI tab,  uncheck "/SAFEBOOT" and click OK to restart your computer

Regarding the Security Center, you could check in HKEY_LOCAL_MACHINE\SOFTWARE \Microsoft\Security Center to make sure AntiVirusDisableNotify is set to 0.  A value other than blank or 0 will disable this option (if you make any changes to the registry be sure to first make a backup, of course).

Also, if you don't already have a third party firewall this would be a very good time to install one.

There is a chance additonal malware has been downloaded so you will want to scan with AVG Anispyware, A-Squared, SuperAntispyware, etc.   Post again if you need any additional help with this.

Oh and, btw, you probably already know that no antivirus, antispyware, anti-whatever is 100%.  There will be times that Panda misses something another tool catches.  Work on layered protection and safe practices rather than seeking perfection.



Offline BJ_GeOrgE

  • Avast Evangelist
  • Sr. Member
  • ***
  • Posts: 350
  • prevention is better than cure
Re: Avast got owned! Shame shame
« Reply #5 on: January 01, 2007, 01:37:49 PM »
do u have the file with this trojan to send it to virus@avast.com?if u have the file,create a password-protected rar/zip achieve with this file,and send it by email at virus@avast.com ..dont forget to write the password so they can open the achieve and any further info u think its important about this virus..
OS:Windows 7 Professional 64-bit SP1
Antivirus: Avast Free v8.0.1497/Firewall: Windows Firewall/On Demand: Malwarebytes Free Edition/Other tools: CCleaner