Author Topic: Got fake virus alert off normal website, now avast is getting corrupted, help!  (Read 10533 times)

0 Members and 1 Guest are viewing this topic.

cylistarr

  • Guest
Was surfing the web on an art community website I'm registered at when this thing suddenly popped up telling me that I was infected with all these different viruses and was scanning my computer.  I kinda panicked and opened avast and scheduled a boot time scan right then and hit restart computer.  It did the boot time scan on command and said it caught three viruses (or three parts of one, I'm not sure) something about a java trojan or something.  I moved them to chest and finished the scan, finished restarting and avast's shields were suddenly off, and the program wouldn't obey my button clicks to activate shields.  I then went into add/delete programs and uninstalled it.  I was too stupid to think to delete the stuff from the virus chest first.  After that I reinstalled avast and restarted and did another boot time scan which seemed to work and no viruses were found.  This morning when I got up however, avast was down on my taskbar but I couldn't interact with it and so I restarted the computer once again and when it came back up all the realtime shields were off and would not respond to my clicks.  I am very frustrated and a little scared about what's going to happen to my information.  Any help with this would be greatly appreciated.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
There may be some remnants to kill that are interfering with Avast

Download OTL  to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
c:\system volume information|_REGISTRY_MACHINE_SOFTWARE;true;true;true /FP
CREATERESTOREPOINT




  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

cylistarr

  • Guest
Thank you, I did as you suggested and it is finished with a report txt file popping up after.  What do I do with this information?  What do I do now?

Offline danny96

  • Malware Fighter
  • Advanced Poster
  • **
  • Posts: 668
  • No-malware!
Thank you, I did as you suggested and it is finished with a report txt file popping up after.  What do I do with this information?  What do I do now?
URL of website?
Real-time protection and Firewall: COMODO Internet Security 12.0.0.6810 -- Additional Protection: Web Of Trust, Ublock, NoScript, Malwarebytes Premium, Avast! Online Security, Hitman Pro -- OS: Windows 10

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Could you attach the logs to your next post please

Use the browse button to get to the log and then post

cylistarr

  • Guest
Website is/was my favorite art community website, www.deviantart.com .

cylistarr

  • Guest
I hesitate to do this, as it would make public a very large number of files and programs that I have on my computer it would seem from reading it...is there any way a hacker could benefit from the information? Is there anything specific you could tell me to look for instead?

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
As soon as I have downloaded the log then edit the post containing the log and remove it from the attachments  ;D

cylistarr

  • Guest
Alright.
« Last Edit: January 16, 2011, 05:48:11 PM by cylistarr »

argus

  • Guest
As soon as I have downloaded the log then edit the post containing the log and remove it from the attachments  ;D

lol  ;D

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Got 'em you may delete them now from the post

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
It looks like MBAM has got them all, all I can see is a changed proxy setting.  Could you try a repair of Avast and then update and re-run MBAM posting the log here

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Quote
    :OTL
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:8893
    O4 - Startup: C:\Documents and Settings\PyroNeko\Start Menu\Programs\Startup\Product Registration.lnk = File not found

    :Files
    ipconfig /flushdns /c

    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [EMPTYFLASH]
    [CREATERESTOREPOINT]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done

cylistarr

  • Guest
I'm going to sound quite stupid saying this, but..what is MBAM?  Also, how do I repair avast?  Uninstall and reinstall or..?  Do I do this first and then run "OTL"?

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
You do have MBAM on your system

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

To repair avast go to control panel > Add/remove programmes and select Avast
On the left will be several options  > Select repair

cylistarr

  • Guest
I'm sorry I'm not doing this in the right order I think.  I tried to repair avast by going to add/remove programs and choosing the option "repair" however it encountered an error:  "Error processing packages Please use full update" then gave me an option to say "ok" or view log file, in which I noted it said some things didn't exist.  I can go ahead and run Malwarebytes (sorry I had no idea that was MBAM) anyway..but I think I can only uninstall avast at this point.  Should I do so?