Avast! Blocked a process as soon as I started my computer

Viruses and worms
1

Today a process called spsetup.exe was blocked by Avast! as soon as I started my computer and it surprised me.

About half a year ago, I had started noticed some command windows popping up now and then when I booted my computer back up from hibernation. Then sometimes when I was typing, the cursor stopped moving and I had to use my mouse to click back into the box to keep typing. One day when I was logging in to an important personal account, I entered my username and password, but I was redirected to yahoo and I was told that the website was not found.

All of these things made me wonder if there was some kind of malware or trojan in my computer. Could anyone help me with this, please?

2

That file is part of the conduit malware.
Please follow the instructions and ATTACH the logs to your next post:
https://forum.avast.com/index.php?topic=53253.0

3

where is the spsetup.exe file located in your comp … full file path ?
file can belong to Dell / Conduit crapware / IObit …

you may also upload it to www.virustotal.com and test it
post link to scan result here

4

Thank you for replying!

I have attached the log to this post.

As for the file path, I am not able to find it. I know that Avast! showed me what it is with a pop-up box, but I am not able to find the information contained in the box again. The only one I found while searching with explorer is spsetup[1].exe, but I am not able to direct to that location with VirusTotal. The full file path is C:\Users*my name*\AppData\Local\Microsoft\Windows\INetCache\IE\MKROZC6G\SPSetup[1].exe

Thank you again!

5

well you have a ton of crap in there (so guess it was conduit as Eddy said) … also attach Farbar recovery scan log from the guide Eddy gave you

6

:o I had never known! Although I have always suspected there was something fishy… Here are the other two logs. Thank you again!

7

Just lots of adware is all :slight_smile:

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = C:\ProgramData\SetStretch.exe C:\ProgramData\SetStretch.VBS

CMD: bitsadmin /reset /allusers
CMD: DEL %TEMP%*.* /F /S /Q
CMD: RD /S /Q %TEMP%
REBOOT:

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

8

Phew~~ that sounds like the problem is not too severe~~ thank you very much! The Farbar log is posted, and the other log is coming.

9

Here’s the AdwCleaner log. Thanks again!

10

How is the computer behaving now ?

11

It’s only been about half an hour after rebooting but so far so good. Thank you! :slight_smile: Can you tell me if Avast! has a function that detects PUPs?

12

Yup select Scan (you will need to do each type of scan separately)
Select settings
Select Sensitivity
Select PUP’s and OK out :slight_smile:

13

I didn’t even think to look there. Thank you!

14

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

15

Fancy! :wink: Will take these steps tomorrow~~ 8) Thank you again :slight_smile:

16

My pleasure :slight_smile:

17

Here’s a joke I found on the internet:

Tech Support : “I need you to right-click on the Open Desktop.”
Customer : “Ok.”
Tech Support : “Did you get a pop-up menu?”
Customer : “No.”
Tech Support : “Ok. Right click again. Do you see a pop-up menu?”
Customer : “No.”
Tech Support : “Ok, sir. Can you tell me what you have done up until this point?”
Customer : “Sure, you told me to write ‘click’ and I wrote ‘click’.”

I feel so happy that your instructions are so clear and fool-proof that I am able to follow all of them with no problems. It must be hard to help those of us who don’t know too much about computers!

Have a good evening. =)

18

I like that one :slight_smile: