I started getting a popup today when I logged on saying Avast has blocked a Malicious URL stemming from rundll.exe in sysWOW64.
I did a full scan and while Avast did find a couple things the thing causing it apparently wasn’t one of them. A light scan with Windows Malicious Software Removal Tool found nothing also and I’m running a full one as I type.
Instruct me oh gurus of virus destruction.
UPDATE: full scan with Windows Malicious Software Removal Tool found nothing, going to try Malwarebytes. Doubt it’ll find anything but it couldn’t hurt. Would blocking the offending program in Windows Firewall help?
UPDATE2: Malwarebytes didn’t get it either but it did find things Avast missed. Haven’t see the popup after running it though.
This needs further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware.
Use the information about getting and using the tools and attach the logs here, not in the LOGS topic.
Ok I think I have the logs you wanted. Dunno what the issue is so I assume the you don’t want the items listed under Specific Infection Logs.
EDIT: Oh wait the aswMBR is supposed to be posted not attached
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-02 02:13:16
02:13:16.546 OS Version: Windows x64 6.1.7601 Service Pack 1
02:13:16.546 Number of processors: 4 586 0x2505
02:13:16.546 ComputerName: ANDREW-PC UserName: Andrew
02:13:18.730 Initialize success
02:13:18.808 AVAST engine defs: 12060101
02:13:22.833 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IdeDeviceP2T0L0-3
02:13:22.833 Disk 0 Vendor: ST3500413AS JC45 Size: 476940MB BusType: 3
02:13:22.864 Disk 0 MBR read successfully
02:13:22.864 Disk 0 MBR scan
02:13:22.864 Disk 0 Windows 7 default MBR code
02:13:22.880 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
02:13:22.896 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 476838 MB offset 206848
02:13:22.958 Disk 0 scanning C:\Windows\system32\drivers
02:13:36.046 Service scanning
02:13:46.935 Modules scanning
02:13:46.935 Disk 0 trace - called modules:
02:13:46.966 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
02:13:46.982 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa800474a060]
02:13:47.497 3 CLASSPNP.SYS[fffff8800198343f] → nt!IofCallDriver → [0xfffffa80044e3580]
02:13:47.497 5 ACPI.sys[fffff88000ec57a1] → nt!IofCallDriver → \Device\Ide\IdeDeviceP2T0L0-3[0xfffffa80044e5060]
02:13:49.057 AVAST engine scan C:\Windows
02:13:55.156 AVAST engine scan C:\Windows\system32
02:15:40.347 AVAST engine scan C:\Windows\system32\drivers
02:15:50.051 AVAST engine scan C:\Users\Andrew
02:23:49.190 AVAST engine scan C:\ProgramData
02:24:39.266 Scan finished successfully
02:24:54.866 Disk 0 MBR has been saved successfully to “C:\Users\Andrew\Desktop\MBR.dat”
02:24:54.866 The log file has been saved successfully to “C:\Users\Andrew\Desktop\aswMBR.txt”