Hi, I´m new in this forum.
I´m looking for help.
I´ve made this post trying to follow this guideline
http://forum.avast.com/index.php?topic=14433.0
- How was it detected? What was scanning, you yourself or the back-ground scanner?
Did the message come from the avast Network Shield or Webshield or were you alerted via an avast Webreputation alert ? When did the message occur on a download, unzipping, opening a file, mail or mail-attachment, etc.
A capture of the message screen as image can be helpful or what the message says and
where the suspicious file was detected.
It´s not my machine, it´s from a relative.
Were detected on a in depth scan and in a start-scan. Both were made because the pc started to get slow.
Btw, avast is running on this machine from like three yearsago.
When MS Windows starts, it gets automatically disabled. It can be enabled by clicking on the icon, but always starts disabled, (when the icon is with the little cross)
At the momen what I have done was
- An avast start scan (log included)
- An avast deep scan (log included)
the infected files were moved to the vault chest
then I did what is said in
http://forum.avast.com/index.php?topic=53253.0
-
AdwCleaner (log included)
-
Malwarebytes’ Anti-Malware (log included)
-
OTL (logs included)
-
aswMBR.exe (log included)
---- all logs are in ANSI format ----
- What was the source of the file, where did the file come from?.: e.g. address, URL, source.
Don´t know. Many relatives, included childrens, use this pc.
-
When was it downloaded or received?
Don´t know -
What is the exact file name with extension.
Don´t know. I´ll put all the logs requested. -
What was the exact wording of the message that the AV program came up with? This is important for later. Right click the asvast ball and left-click show last pop-up message!
No message. Avast, like I said befor, starts disabled. -
Now go back and do nothing yet. Scan the particular file once again with your AV product.
A. The message is in the same wording: maybe positive alert
B. If the message is not in the same wording or the scan does not find up anything this could be a false positive. -
Check with an on line scanner or update to Virustotal for a second opinion. VT resides at http://www.virustotal.com/index.html
You can do an URL scan or file-scan. Also give the MD5 hash that is given further down the scan result page under additional information. This can help to identify the malware file.
Other scan results can be found for a suspicious URL or link at: http://vscan.urlvoid.com/file/
for filescans alternative scanners are: VirSCAN http://virscan.org/
Metascan http://www.metascan-online.com/
or you can ask on the forums to have the URL or link in question scanned with
various scanners. A FP is more likely if the file is only flagged by avast and GData.
There are many infected files, I did VirScan with modpro.exe
SHA256: 986c96564b89aca045e31a84cd3ccd30eeeb1b7d4819aa2b5f9bcd99f8b16c8d
SHA1: 18fa5d8c42efe1288b64dbc977f35535a07b6864
MD5: e1340af626080c1a697a09affa16c464
File size: 385.0 KB ( 394240 bytes )
File name: modpro.exe
File type: Win32 EXE
Detection ratio: 34 / 46
Analysis date: 2013-03-05 17:06:41 UTC ( 0 minutes ago )
0
1
Less details
Analysis
Additional information
Comments
Votes
Antivirus Result Update
Agnitum Trojan.PWS.Delf!BmlovFadupE 20130305
AhnLab-V3 Trojan/Win32.Delf 20130305
AntiVir - 20130305
Antiy-AVL Trojan/Win32.Delf.gen 20130305
Avast Win32:Rootkit-gen [Rtk] 20130305
AVG Generic26.BDPJ 20130305
BitDefender Trojan.Generic.7150917 20130305
ByteHero - 20130304
CAT-QuickHeal - 20130305
ClamAV - 20130305
Commtouch W32/Trojan.PNPF-7705 20130305
Comodo UnclassifiedMalware 20130305
DrWeb Trojan.PWS.Banker.63539 20130305
Emsisoft Trojan.Generic.7150917 (B) 20130305
eSafe - 20130211
ESET-NOD32 Win32/Spy.Banker.XCC 20130305
F-Prot - 20130305
F-Secure Trojan.Generic.7150917 20130305
Fortinet W32/Delf.XF!tr 20130305
GData Trojan.Generic.7150917 20130305
Ikarus Trojan-Banker.Win32.Delf 20130305
Jiangmin Trojan/Banker.Delf.wh 20130304
K7AntiVirus Trojan 20130305
Kaspersky Trojan-Banker.Win32.Delf.xf 20130305
Kingsoft Win32.Malware.Heur_Generic.A.(kcloud) 20130304
Malwarebytes - 20130305
McAfee PWS-Banker.gen.fj.a 20130305
McAfee-GW-Edition PWS-Banker.gen.fj.a 20130305
Microsoft - 20130305
MicroWorld-eScan Trojan.Generic.7150917 20130305
NANO-Antivirus Trojan.Win32.Banker.ntjlv 20130305
Norman Suspicious_Gen5.AAOO 20130305
nProtect Trojan/W32.Agent.394240.EA 20130305
Panda - 20130305
PCTools - 20130305
Rising - 20130305
Sophos Mal/Generic-L 20130305
SUPERAntiSpyware - 20130305
Symantec WS.Reputation.1 20130305
TheHacker Trojan/Delf.xd 20130305
TotalDefense Win32/DfSpy.CD 20130305
TrendMicro TROJ_AGENTT.AAF 20130305
TrendMicro-HouseCall TROJ_AGENTT.AAF 20130305
VBA32 TrojanBanker.Delf.xr 20130305
VIPRE Trojan.Win32.Generic!BT 20130305
ViRobot Trojan.Win32.A.Delf.394240.C 20130305
-
Go get informed ask a Virus Encyclopedia or Virus Central. Remember Google is your best friend, also put a question on a forum.
-
Make an informed decision on the basis of what you have found.
-
Inform others about what you have learned, if the file came from a reliable source, author, programmer etc. send a friendly e-mail with your findings. Also send a mail to virus AT avast dot com. If you send a suspicious file there for detection password zip this as an attachment and put the password in the mail. This will help us all and in case of a non-detect avast will add it to avast detection or in the case of a false positive remove that with a next virus update.
Waiting for help, thanks.