i’ve avast 6.0 freware version, updated today, on a portatile pc with wondows XP professional.
Making a complete scan Avast detected Autorun-gen
I put it in trash bin as suggested.
Then Avast suggested me a boot scan that detected Win32:Confi. I canceled it as suggested
then… in my rescue folder i had Combofix. I updated it and make it run. I know i sould have to ask someone before… but the last time my pc was infected i did it an so…
Do you think Avast alone defeated those malwares?
i can attach the log report file is requested…
Thanks in advance to anyone would like to help me.
Simone
That looks good, are you unable to open control panel ?
Download OTS to your Desktop and double-click on it to run it
[*]Make sure you close all other programs and don’t use the PC while the scan runs.
[*]Select All Users
[*]Under additional scans select the following Reg - Disabled MS Config Items
Reg - Drivers32
Reg - NetSvcs
Reg - SafeBoot Minimal
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check
[*]Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Please attach the log in your next post.
Nope looks OK there are a few traces to go but that is all… This will also empty your temporary folders which seem to be a tad full
Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.
[Unregister Dlls]
[Win32 Services - Safe List]
YN -> (Comodo Anti-Virus and Anti-Spyware Service) Comodo Anti-Virus and Anti-Spyware Service [Disabled | Stopped] ->
[Driver Services - Safe List]
YY -> (catchme) catchme [Kernel | On_Demand | Running] ->
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {9AA2F14F-E956-44B8-8694-A5B615CDF341} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer Extensions [HKEY_USERS\S-1-5-21-1659004503-287218729-839522115-1003\] > -> HKEY_USERS\S-1-5-21-1659004503-287218729-839522115-1003\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value error.]
[File - Lop Check]
NY -> Avg7 -> C:\Documents and Settings\All Users\Dati applicazioni\Avg7
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here
While we appreciate your help, Essexboy is in the middle of malware removal. Some tools are already on the OP’s machine that he will eventually need to remove or instruct the OP how to remove. Therefore we will let Essexboy continue his malware removal on his own for now. Thank you.
Start OTS. Copy/Paste the information in the quotebox below into the panel where it says “Paste fix here” and then click the Run Fix button.
[Unregister Dlls]
[Win32 Services - Safe List]
YN -> (Comodo Anti-Virus and Anti-Spyware Service) Comodo Anti-Virus and Anti-Spyware Service [Disabled | Stopped] ->
[Registry - Safe List]
< Internet Explorer Settings [HKEY_CURRENT_USER\] > ->
YN -> HKEY_CURRENT_USER\: "ProxyServer" -> 192.168.0.22:61380
< FireFox Settings [Prefs.js] > -> C:\Documents and Settings\user\Dati applicazioni\Mozilla\FireFox\Profiles\7rdnl2j2.default\prefs.js
YN -> network.proxy.backup.ftp -> "192.168.0.22"
YN -> network.proxy.backup.ftp_port -> 61380
YN -> network.proxy.backup.gopher -> "192.168.0.22"
YN -> network.proxy.backup.gopher_port -> 61380
YN -> network.proxy.backup.socks -> "192.168.0.22"
YN -> network.proxy.backup.socks_port -> 61380
YN -> network.proxy.backup.ssl -> "192.168.0.22"
YN -> network.proxy.backup.ssl_port -> 61380
YN -> network.proxy.ftp -> "192.168.0.22"
YN -> network.proxy.ftp_port -> 61380
YN -> network.proxy.gopher -> "192.168.0.22"
YN -> network.proxy.gopher_port -> 61380
YN -> network.proxy.http -> "192.168.0.22"
YN -> network.proxy.http_port -> 61380
YN -> network.proxy.no_proxies_on -> "localhost,127.0.0.1"
YN -> network.proxy.share_proxy_settings -> true
YN -> network.proxy.socks -> "192.168.0.22"
YN -> network.proxy.socks_port -> 61380
YN -> network.proxy.ssl -> "192.168.0.22"
YN -> network.proxy.ssl_port -> 61380
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {9AA2F14F-E956-44B8-8694-A5B615CDF341} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\"{08B0E5C0-4FCB-11CF-AAA5-00401C608501}" [HKLM] -> [Reg Error: Value error.]
YN -> CmdMapping\\"{CCA281CA-C863-46ef-9331-5C8D4460577F}" [HKLM] -> [@btrez.dll,-4015]
[File - Lop Check]
NY -> Avg7 -> C:\Documents and Settings\All Users\Dati applicazioni\Avg7
[Custom Items]
:Files
ipconfig /flushdns /c
:end
[Empty Temp Folders]
[EmptyFlash]
[CreateRestorePoint]
The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here
I will review the information when it comes back in.
i guess something went wrong.