No support email from Avast

[maxweston]

I have been trying to log a support call with Avast for months, when I fill in the application I am told I will receive
an email with links to verify or validate my registration. This email never arrives so I cannot register my support call
so I guess I will have to try and do it here on the forum.

Why does Avast not detect and remove Zlob DNS Changer, every computer (5) I own is infected with this virus
and I cannot remove it. It would seam that this virus is invisible to Avast 4.8, anyone have any clues?

[onlysomeone]

how do you know that this virus is there?

do you have an infected file which you can send to the avast virus labs?

[DavidR]

Does your ISP or email service provider use anti-spam software, if so ensure that avast.com is added to the white list or try using a different email address.

If you have a sample of it send it to avast.
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive/undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn't already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.

Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

[maxweston]

I know the virus is there because Spybot picks it up on every scan. Once spybot removes the registry entry the system is re infected in minutes.
The sympoms of the virus is that every time you pick a URL to navigate too, the link is redirected to other sites that have no relationship to the site originately selected. The only way I can get a link to work is by copy and pasting the url into the web browser.

I have scanned every computer and every file to try and find which file is infected but no joy, this virus is driving me nuts. :'(

[DavidR]

Surely if spybot S&D is detecting it then it would report the file name and location, surely it should also attempt to place it in the Quarantine area.

If you find it then try to check it out at VT.

You don't say what you scanned with, you could try these.
If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
1. SUPERantispyware On-Demand only in free version.
2. MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.

[maxweston]

Spybot detects a registry change and tells you where it is but does not identify its origin, or if it does I cant find it.
I scanned with Avast 4.8
I have found a file stored in the Spybot Recovery folder called ZlobDNSchanger.zip, can I send this to someone?

[DavidR]

You can try to send it to virustotal, but I expect if it is in the S&D Recovery area it would be password protected, which would put the kibosh on that idea. It really is so long since I used S&D and I don't know if this zip file is the creation of S&D to package away the suspect/infected file inside.

If the file is in the S&D Recovery area (quarantine) that would account for why nothing else finds anything, unless you are also saying that even with it in the S&D quarantine you still experience problems.

You would have to recover it I suspect and again I don't know what S&D would do but I suspect it would put it back in the original location and that isn't advised as it would effectively be reactivating the malware.

You say you found it in the Spybot Recovery folder called ZlobDNSchanger.zip, was this using windows explorer ?
If so you should open S&D and look at the quarantine area, that should show any file and you should be able to right click on it and check the properties, this may give such info on the original file name and location. It may also give options on what functions/actions you can perform.

I'm sorry I can't be more helpful I don't use S&D as I believe there are better applications like the two I suggested you scan with.

[maxweston]

Hi David,
Thankyou for your help, I ran combofix as you suggested but no joy, the the problem just reapears shortly after. I think both S&D and Combofix are
both finding and fixing the result rather than killing off the source.

My original post also asked why I was not getting a verification email from Avast so I could register and communicate with their support people but
I have probably asked a question that is too hard to fix. The easy thing for Avast to do is ignore the problem and hope it goes away. From what I can find out this Trojan has been around for quite a while now (I have found references going back to 2006) and I think that these people have had more than enough time to put this one to bed. I used to use Trend Micro and got rid of it because of its intrusive nature and dramatic slow down of my system but I have to say that in all the time I owned it I never had a problem with viruses or Trojans.

It's a shame that Avast hasn't been able to sort this problem because I really liked their software, it's well presented and runs in the background so you don't know its there. Unless I get some kind of feedback from Avast I will be on another mission to find something else to use.

In the meantime I thank you once again for your interest in helping me try to solve the problem. It's a shame that Avast hasn't.

Regards
Max Weston.

[DavidR]

Well I think the forums is a better option, but in cases of not receiving emails, it is often caused by an over zealous spam filter, does your ISP (or you) use an anti-spam ?

If so allow avast.com or asw.com (if you are getting email notifications of posts, then asw.com is getting through).

Often ISPs say they don't have a spam filter but the greatest majority do, some put it in a spam folder others delete without notification. So you could try using a different email address, one of the free accounts like yahoo and see if that gets through.

I doubt the question is to hard to fix, but the least I would expect is an acknowledgement, so something is blocking emails I believe.

Whilst a trojan 'name' might have been around for ages new variants are frequently spawned specifically to try and avoid detection.

There is a uninstall utility for trend's AV which might be worth running to ensure all remnants are gone as this too can impact on future AVs. Remove Trend Micro's AV, see http://esupport.trendmicro.com/support/viewxml.do?ContentID=EN-1034142&id=EN-1034142#P79_1922

If you haven't already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
1. SUPERantispyware On-Demand only in free version.
2. MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.