Got fake virus alert off normal website, now avast is getting corrupted, help!

[essexboy]

Yes looking at the report - safesurf has a nice little spiel here.  Run Malwarebytes to see if there are any orphans left 

Hello EGHelmut and welcome to the forum,

Since you updated Avast from 5.1.864 to 5.1.889, I suggest that you do an uninstall and clean (fresh) install of Avast 5.1.889 to fix your problem.

1. Save a copy of newest version of Avast for the product you need and save it to your HDD:

Build 5.1.889 download files:
Free:    http://files.avast.com/iavs5x/setup_av_free.exe
2. Download the Avast Uninstall Utility http://www.avast.com/uninstall-utility and save it to your HDD (it has uninstall tools for all Avast versions and products). 
3. Disconnect from the Internet at this time.
4. Go to Control Panel and uninstall Avast through Add/Remove Programs if possible and reboot.
5. If Step 4 fails, boot into Safe Mode (hit F8 repeatedly) and run the Avast Uninstall Tool.  Uninstall all previous versions you had on this machine at this time.
6. Reboot.
7. Install the newest version of Avast and reboot.
8. Get Internet access and register your copy for Free:
    Free – http://www.avast.com/registration-free-antivirus.php
9. Update the Avast definitions.

Let us know if this fixes your problems.  Thank you.

[cylistarr]

I've done everything you told me to do, avast is newly installed (and updated) MBAM found 2 things the log of which I'm posting below.  I ran OTL as you said and it ran for awhile then asked for a restart, which I did.  When the computer came back up it gave me a notepad log file of what it (OTL) did.  However, right now my taskbar system tray icons besides avast and spyware terminator (which I've had for some time) do not show up, and there are usually about 6.  What else do I do?

MBAM log file you requested:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5532

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

1/16/2011 11:42:28 AM
mbam-log-2011-01-16 (11-42-28).txt

Scan type: Quick scan
Objects scanned: 169916
Time elapsed: 7 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\PyroNeko\local settings\Temp\6652157.678338989.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
c:\documents and settings\PyroNeko\local settings\Temp\jvuevjnto\hqxkkrfuerb.exe (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.

[essexboy]

Are the tray icons hidden ?

What are your current problems ?

[cylistarr]

No, they were not hidden, the option to hide wasn't necessary because they simply weren't there.  I rescheduled a system scan using avast and it's running now, so I don't know what has happened but nothing as of yet has shown up.  I'll be able to figure out more once the scan is done and it reboots.  I'm thinking (ok I'm hoping) that it's all gone and everything is fine.  *crosses fingers*  Thank you so much for all the patient help and assistance you've given!

I do have one more question when you have time.  Is there any way to prevent something like this from happening in the future? (Outside of never going to deviantart again *cry*)  I was under the impression that I had programs like avast so this wouldn't happen; so I am slightly unsure now.  Any thoughts would be greatly appreciated.

[essexboy]

That is the problem with drive by downloads, they are continually changeng.  On the site did you notice the problems after clicking on a picture or downloading it ? The site itself caused no alarms for me, but then I just went to the front page 

Whatever it was that you had all it was able to do was damage Avast for a bit and add a proxy to your system. 

Which is a lot better than some other AV's would have been able to do

Once you are happy I will remove my tools and tidy you up

[cylistarr]

I see, well I've gone there less lately (deviantart) because surfing the website has twice before tried to infect me, those other times avast caught it before it had a chance to infect me.  This is the first time I actually got infected from it.  The other times, as this time, the virus came from browsing someone's individual art from their gallery.  It is all hosted on deviantart's website so as far as I know it didn't come from an outside source.  I can browse the front page, my own page and account pages with no issue, but for some reason it's after I've browsed a few pieces of art (no downloads ever, just open the arts' page) that's when it hits.  Not every time of course, or I'd never have gone back after the last two times.

I've restarted again just to see what would happen and everything seems normal so I think it's gone.  Thank you so much for you help! It especially means a lot to me that the support at avast will assist those like myself who are using the free version (I plan to remedy that though, your customer service has kinda talked me into purchasing haha!). If you were here I'd hug you!:)

[argus]

cylistarr

The recommendation that you install this program http://amf.mycity.rs/programs/mc/mcshield/

It will prevent infection by computer via USB flash drive, mobile phone or any memory card.
And not only will prevent infection, but will immediately clean Memory card or external HDD

[essexboy]

I am just an Avast user like you 

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

 Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself.  MBAM can be uninstalled via control panel add/remove along with ERUNT.  But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

   Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 23.
  
• Click the "Download" button to the right.
  
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  
• Click on Continue.
  
• Click on the link to download Windows Offline Installation (jre-6u23-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u23-windows-i586-p.exe and select "Run as an Administrator.")
  

.
SPRING CLEAN

 
Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check




Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
 
Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update
  

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?
Keep safe  :wave:

[cylistarr]

I've done what you've suggested and it's running smoothly.   Thank you again essexboy, fellow avast user and wizard extraordinaire!

[essexboy]

My pleasure - keep safe now.  Stick around the forum can be fun