Over the last few weeks I have been getting the following pop up message from Avast
" A program is trying to shut down system services and disable real time shields…"
This happens at no particular time when the system is running. Based on information from the Avast web site I ran a scan right after the pop up appears and found nothing. I have also done an entire system scan, Malawarebytes scan, and a Superantispyware scan. All found nothing.
I also did a Avast boot scan and found and removed two Java related baddies.
One was JS:decode-fn and the other Java Bitcoin-A
Subsequent scans show the system is clear after removal. The pop ups continue
I have Avast version 7.0.1474 and Virus definition file 121215-2
The pop up gives no indication of what the requesting program is.
i have the same problem except my shields are not even active.they all say unknown.i cant get it to do a scan either.i keep getting the same message i dont have anymore endpoints.i have updated,uninstalled and re-installed this program multiple times,and get the same end result.frustrated. if you have any advise please contact me.
[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
This is the report from the TDSS Killer. A number of medium risk objects were found but none had the cure option. I am sure this will me a lot more to you than it does to me. This site would not allow me to paste the report (too many characters) so am attaching as a text file
MBR is good. Has this happened again ?
Attaching files is the best bet for this forum as the character limit is a bit restrictive
Download and Install Combofix
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
I can not say yet if the original problem is still occurring. It has happened at different times during my day and not everyday either. Will advise when it happens again, hopefully it will not.
Let me bring up what might be a related or unrelated issue.
I primarily use the latest Firefox for my browser. Over the last few days I noticed random pop ups on pages noted as “coupondropdown.com etc.” I did a number of searches on the net on how to rid this. Malware scans and Avast found nothing. I could not find anything on my system to delete such as files etc. This problem seemed to be isolated to Firefox and did not seem to appear in IE or Chrome.
I deactivated all of the add-ons and extensions with-in Firefox, and the pop ups disappeared. I reactivated ones that I do need but have not seen the pop-ups return. Again this all happened within the last day or two. None of the add-ons I still have deactivated are new but they may have had an update.
(I know I’m sorta butting in here) Have you reinstalled firefox?, I had Babylon on my firefox, (Due to it auto installing itself), Since Babylon injected itself straight into the browser itself, I couldn’t remove it, regardless of what I done, I eventually found a solution, but I had to actually go into firefox’s settings, like fully into the browser and find the actual lines of code that were babylon related and disable them, You may get what I’m trying to say. (I may be totally wrong, but hey, just throwing it in there)
User32 is not showing the correct MD5 although Combofix is not overly concerned I will replace it with a good copy. For firefox maybe an updated run with AdwCleaner
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the quotebox below into it: