59553781-e898-4685-8ef1-30444b49dfef.exe (On boot)

[system]

90% of the scans are showing up with some of these files cannot be scanned messages.

Just wanted to give this additonal peice of information.

[essexboy]

It is what Avast calls intelligent scanning… If a file has already been scanned and has not been used or modified in any way then it is not required to scan it again until it changes

avast! Intelligent Scanner:

Can reduce the number of required file scans by up to 80% through a white list of proven safe applications. Files identified as safe are not rescanned unless they change.

Files that cannot be scanned are just that, they are either password protected or corrupted

[system]

Ok, these are all in the AppData folder/roaming side. I have been considering running OTL but i was wondering should i run malwarebytes first?

[system]

Also when i researched the OTL system i noticed that people are saying the same person made the combofix application. Not sure if thats true but felt i should atlest ask!

[essexboy]

Combofix is only used when required for specific infections

But a MBAM run would not come amiss

[system]

Running Mbam, Shall post results asap.

[system]

Results are in
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

[essexboy]

Looks good… Methinks that is a benign file

[system]

Yup, I should note that upon rebooting the computer its self i did have one strange thing occuor. The A button was mashing its self to the point where shortcuts where moving around and in the search bar on start bar was typing aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Now i have checked the keyboard its self but it seemed to go away after logging out and logging back into the machine.

I guess thats an odd driver.

[system]

@essexboy post:28

Looks good… Methinks that is a benign file

Yup, just running one more scan, Shall post results.

[system]

@OliPicard post:30

@essexboy post:28

Looks good… Methinks that is a benign file

Yup, just running one more scan, Shall post results.

Scan has come back clean. Thanks essexboy!

[Pondus]

@OliPicard post:24

Also when i researched the OTL system i noticed that people are saying the same person made the combofix application. Not sure if thats true but felt i should atlest ask!

OTL is made by oltimer http://www.geekstogo.com/1888/otl-by-oldtimer-a-modern-replacement-for-hijackthis/
Combofix made by sUBs, working at Malwarebytes. http://forums.malwarebytes.org/index.php?showuser=2164

[system]

@Pondus post:32

@OliPicard post:24

Also when i researched the OTL system i noticed that people are saying the same person made the combofix application. Not sure if thats true but felt i should atlest ask!

OTL is made by oltimer http://www.geekstogo.com/1888/otl-by-oldtimer-a-modern-replacement-for-hijackthis/
Combofix made by sUBs, working at Malwarebytes. http://forums.malwarebytes.org/index.php?showuser=2164

Thanks Pondus, Was wondering whom went where! As for now this issue is resolved. If i do have any questions i know where to come back to!. Thanks Guys

[polonus]

Hi OliPicard,

I also think this temporal file should be considered benign: as it is located in AppData\Roaming and has a format similar to the first part of e.g. 97C4BD54-7A24-4B1D-A3CC-3CD3E55624E8 AT microsoft.com… so supportive of essexboy’s verdict here,

polonus

[system]

@polonus post:34

Hi OliPicard,

I also think this temporal file should be considered benign: as it is located in AppData\Roaming and has a format similar to the first part of e.g. 97C4BD54-7A24-4B1D-A3CC-3CD3E55624E8 AT microsoft.com… so supportive of essexboy’s verdict here,

polonus

Hey Polonus, Yup the roaming data is pretty much safe, my concern was the exe that was requesting access to local host via the Windows/Temp folder.

@OliPicard post:1

Hi, When recently logging in i noticed a request from my firewall to the local host 127.0.0.1 to 127.0.0.1 from port 49391 to 12080

File Name: 59553781-e898-4685-8ef1-30444b49dfef.exe
Location: [DISKPATH]:\Windows\Temp
Behaviour The file disappeared and vanished after i blocked the connection.
It seemed strange and when i started to look for the file it claimed i didnt have permission to look for it. Im very worried about this odd file which showed up.

Hopefully its something simple, I did search for it however it seems to have no orgin.

Hope you guys can help.

Thanks
Oliver

Overall it seems running a couple of programs to clear it up has done the trick.
Many Thanks
Oliver

[essexboy]

OK now I have got around to playing with Avast 8 … Lookee what I found

[polonus]

Hi essexboy,

Excellent work, case closed. The solution was right in front of our eyes and we did not see it for what it was. Victims should thank you for going the extra mile and digging this info up eventually. That is why you are also in a favorite list of mine ;D ,

Damian

[system]

Awesome!, One more question (sorry about this. :D) i just got a new request from avast (4d9c042a-b94c-4341-bbf1-83b0aeed4b4f.exe) trying to connect to 127.0.0.1 should i class it as safe?

Thanks once again and awesome to see that this is avast

[system]

Also found this file under [Disk]\Windows\Temp too. Also vanished after connecting. Acting the same way as the other file.

[system]

Just discovered somthing neat, I went under Digital Signatures and could see Avast has the signature for this peice of software. Case closed indeed. Thanks Essexboy!