win32:fasec and more probs

[elivan]

Hey all.  I picked up a trojan and or virus and am having trouble removing them/it.

I first noticed that when doing a search in google the link would often not lead to what I was clicking on and many of the links all went to the same page.  Some webclick crap.  Either way this has happened before so I ran Avast and sure enough it found a process called win32:fasec and labeled it a trojan located in windows/system32 files.  I clicked to move and was given the warning that it was in use and could not me moved.  After then clicking delete it said that the trojan/virus was in the memory and to do a boot scan whick I ok'd and it went straight into.

Then...nothing.  It didn't find anything and now when I restart my comp the monitor goes black after windows starts but before you get to the desktop page.

I have looked myself in the windows/system32 folder and cannot find the file its calling out.

Doing a Drweb full scan as the express found nothing.

Any ideas or info that you might need to help me?

Thanks

[DavidR]

What is the file name ?
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe
- Or check the source file using notepad C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log and copy and paste the entry.

Ensure that you have hidden files and folders enabled and disable hide system files in Windows Explorer, Tools, Folder Options, Hidden files and folders, uncheck Hide extensions for known file types, etc. see image.

It may be that although the boot-time scan didn't find anything, it is possible that avast still managed to delete the physical file.

####
If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

• 1.  MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
• 2. SUPERantispyware On-Demand only in free version.

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

[Lisandro]

Maybe this help. Read the instructions, download and burn (maybe from another computer), finally use one of this rescue CD's:
1. Avira
2. Kaspersky
3. BitDefender
4. F-Secure
5. Dr. Web