Win32: FASEC Trojan - HELP!

[TX2lefts]

Let me preface this by saying I'm an absolute newbie.
Everything was fine until last night, my brother decided to watch Big Bang Theory episodes online free... needless to say, the site he visited downloaded Win32:FASEC [Trj]. Avast recognized it (and it's many, many alternates) immediately but would/could not move it to the chest or delete it for some reason. Says it's being used by another process or cannot find it/them. Also, my Windows security center has been turned off now and will not let me reactivate it.

I restarted my computer in SafeMode (w/out internet access), as I'm not sure what to do exactly. I am currently on a friend's computer posting this.
Can someone please give me newbie instructions for how to deal with this and/or any other problems.
Also, when I run Avast4.8 system scan it finds absolutely nothing... confused.

[FreewheelinFrank]

Hi TX2lefts,

Please follow the advice here:

http://www.avast.com/eng/win32-fasec.html

[TX2lefts]

Thanks for the quick reply.
My system is up-to-date, but did it again to be sure. When I went to schedule a boot-time scan and the avast warnings keep popping up and now the avast scheduler has frozen and won't restart the computer.
In addition to the avast "access denied"/"being used by another process" warnings, a window popped up saying "Windows Modules Installer stopped working and was closed"... I have no idea.
Ughhh.

[TX2lefts]

Awesome. It finally acted as if it was going to re-start, but instead said that the log-in failed to provide security options and brought me back to the desktop. Avast now has a pop-up saying "Access is denied: Program cannot schedule the boot-time scan".
I knew it wouldn't be that easy.

[FreewheelinFrank]

Do you have Online Armor, by any chance?

http://forum.avast.com/index.php?topic=42233.0

[TX2lefts]

No, at least not that I'm aware of... as I don't know what that is.
I did finally get the computer to reboot and do the scan (don't ask me how), after about 16 tries. However, after the reboot it's been stuck on the Windows Vista "Welcome" screen acting as if it's going to load for about 15mins. I tried restarting again, but it won't.
I'm going to have to power down without a restart and try again.
.......and, same thing. After I log in, it won't go past "Welcome".

[FreewheelinFrank]

You could try any repair/restore options as described here:

http://forums.techarena.in/vista-help/902997.htm#post3494961

Or maybe somebody here more familiar with Vista could help you.

[TX2lefts]

Okay, thank you.
Do you think that if I do a system restore before I've been able to move/view the infected files it will cause a problem? I read somewhere that doing a system restore could duplicate them and cause more problems. ?
I really do appreciate you trying to help. 

[FreewheelinFrank]

Did avast! detect any files during the boot time scan? Did you move them to the Chest?

You might find that you're still infected even after restoring, or than restore doesn't work.

Worth a try, I'd've thought- you can always run further scans later.

An alternative would be to try the usual free adware/spyware scanners, but I don't know if these will install in Safe Mode.

SUPERAntiSpyware Free
Malwarebytes' Anti-Malware

[Download, install and update the programs.
Always select the option to quarantine any malware found rather than delete it, then you will be able to restore files or registry entries wrongly identified as malware- a rare but not unknown event for any malware scanner.]

[TX2lefts]

After the scan it went straight into loading Windows, so I don't know what it found and was not yet given the option to move anything to the chest.
I did a restore for about 4 days ago before the problem(s) began; however, it's still stuck on the Welcome.
The malware programs wouldn't run in SafeMode.
I had hoped after the restore I could install them in regular, but it looks like that's a no-go.
What a mess.

[TX2lefts]

I think upon the Avast boot-scan, it must have deleted or quarinted important startup files. Because before I did that, it was still loading in normal mode. (?)
I'm now attempting the
Restart > F8 > Repair your Computer > Startup Repair option.

...Which located no known problems.
Trying another restart, still not loading.
If startup repair and system restore aren't doing the job, I'm at a loss.

ANYONE WITH KNOWLEDGE OF VISTA??

[Lisandro]

Read the instructions, download and burn (maybe from another computer), finally use one of this rescue CD's:
1. Dr. Web
2. Avira
3. BitDefender
4. Kaspersky
5. F-Secure

After we're sure you're clean (run at least #1 above), we can got further helping you to boot.
Most probably you'll need to repair Vista installation (overinstallation) with the original DVD.

[mkis]

Since you've tried a System Restore, you have already exhausted that option (excepting through a full recovery of Registry). You can turn System Restore off now if you have the chance.

If not following Tech's prescription, then try next boot-time scan with System Restore turned off. Schedule the boot-time scan in Safe Mode if this is possible.

Perhaps Startup Repair option enables you to carry these things out.
Like FF Im not a Vista user but rarely need to do repair on these systems amongst my circle.

[TX2lefts]

Well, I can't download any programs while in safemode. I did run another avast! boot-time scan while in safemode and it located/quarantined the Fasec virus files (said "located virus in operating system") and restarted into normal mode but still won't go past the Welcome screen. It's been there for about 45mins.

I was able to backup my photos/documents/iTunes onto discs/USB from safemode, thankfully. As these were the only things I really cared about, can I have someone reformat the PC and start from scratch you think?
Because nothing else seems to be working.

It's amazing... took all of two minutes for my perfectly fine PC to be completely ruined.

[micky77]

Have you tried any of the rescue discs.You could download any programs from your friends pc.
As for MBAM that will install and run in safe mode
Also you could try safe mode with networking, this may give you a connection