Still have problems with Avast 5.0.677 (free download version)

[CraigB]

Hello, Safesurf.

I removed both using the Uninstaller Tool before rebooting.

- There is nothing checked off in the Update Parameters.

- #2 is checked off (Auto detect).

You could try ticking auto detect on for internet explorer setting's and see what happen's, this is the standard setting on mine.

[SafeSurf]

Do you connect to the Internet by Broadband (cable or DSL) and NOT by proxy?

[Cael]

Hi, Craig. It is already on auto detect.

Safesurf, yes. It is ADSL2+ with no proxies.

[SafeSurf]

Can you please update and run a FULL MBAM scan for me, then cut and paste the log here in the thread.  If anything come up positive, put it into quarantine.  Thank you.

[Cael]

Malwarebyte anti-Malware running on full scan.

16 mins and counting, no infected, about 60k scanned.

This is going to take a while. The last time I did this, it took over an hour.

[SafeSurf]

Either I or someone else will check in with you later.  I just want to make sure you are not dealing with more malware. 

Should you have malware on your MBAM scan, then please check the information on the first post of this thread under Virus/Worms for you to check your machine for malware: http://forum.avast.com/index.php?topic=53253.0. 

Follow the directions of obtaining the OTL logs.  Post the two (2) OTL log as an attachment (Additional Options > Attach > Browse (the logs will be on your desktop > Post).  We can then analyze this in the meantime for any malware, and if any malware is found we will refer you to one of our malware experts.  Thank you.

Before I sign off, do you have any questions?

[Cael]

Not really. At this stage, I think you are the guys who'd have more questions than I do. My only question is why did Avast fail now, when it's worked for years?

Thanks for your help so far. I will post the log as soon as this is done.

[SafeSurf]

Not really sure.  We have to rule out malware. 

Do you have any other security software on your machine besides Avast?  What do you have for firewall (FW) currently and in the past?  How about other security software (besides MBAM)?

[Cael]

At the moment, there is still no malware. I think it is almost done, being over the 1 hour mark.

I only have Avast on.

Firewall is bog standard WinXP Pro SP2. I have never used any other firewall.

I am pretty sure MBAM isn't even on unless called manually.



One thing, though, I got a bell from Avast saying that it detected MBAM or something connected to MBAM as malware (it listed MBAM as the originating software, if I read it right).

The files in the virus chest are:
A0075722.exe - C:\System Volume Information\_restore(whole bunch of numbers and letters)\RP817 - last changed 23/07/1999
A0077235.sys - C:\System Volume Information\_restore(same bunch of numbers and letters as above)\RP820 - last changed 03/08/2004

Both seems to be connected to restore points in my system and seems to be triggered when MBAM scanned them.

[CraigB]

Probably a good idea to get rid of all those old restore point's anyway, you can delet all at once through windows disc cleaner and dont worrie , it wont delet your last one by safety default. Ccleaner only delets one at a time which can take a long time depending on how many you have. Do you not have the exclusions set up in avast for malwarebyte's.

[Cael]

Nope. I am using them as is I haven't looked at modifying the default config for both, and since both worked so well for me in the past, I never felt the need to tinker.

[Cael]

That took a lot longer than I expected...

Beginning log...

*********************************************
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4318

Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

27/09/2010 20:24:48
mbam-log-2010-09-27 (20-24-48).txt

Scan type: Full scan (C:\|)
Objects scanned: 363938
Time elapsed: 1 hour(s), 40 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
**************************

End log



Hope this helps...

[CraigB]

Nope. I am using them as is I haven't looked at modifying the default config for both, and since both worked so well for me in the past, I never felt the need to tinker.

You should definatly have the exclusions set in avast settings/ exclusions/ and also in file system shields/ exclusions. Copy and paste these one at a time into those two areas that i mentioned, these are for xp systems   
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll
C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll
C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\rules.ref
C:\Windows\System32\drivers\mbam.sys
C:\Windows\System32\drivers\mbamswissarmy.sys

[Cael]

Was that file system shields/expert settings/exclusions, Craig?

And all three boxes (R/W/E) should be ticked?

[CraigB]

Was that file system shields/expert settings/exclusions, Craig?

And all three boxes (R/W/E) should be ticked?

Yes and in settings exclusions as well, and all three boxes R/W/X should be ticked by default