Avast keeps reporting a WanaCry trojan

system · 2017-06-05T10:06:06.000Z

Since the beginning of June, I’ve had popup notifications from Avast every few hours that it has quarantined mssecsvc.exe from C:\WINDOWS because it was a trojan (WanaCry) or something. I currently have 14 copies of said files quarantined by Avast. One of these cases spooked me as it occurred just as I opened my bank’s identification page to log in to my bank account.

Last time I did a full scan was first of June, nothing alarming there. I also check periodically with Malwarebytes’ Anti-Malware, nothing found until today when it found Ransom.WannaCrypt (log file included).

I am using the free version of Avast 170605-0, 17.4.2294. My OS is Windows 7 x64.

Looking at properties of mssecsvc.exe from Avast quarantine, it’s grouped as infected, its description is “Win32:WanaCry-A [Trj]” and for viruses it has a bunch of strings that all include either WanaCry or WannaCry with letters A, C, D, E, F, H and J. Each string also includes “[Trj]Always!strg”.

How should I react to this? Thanks in advance.

Pondus · 2017-06-05T11:14:28.000Z

Malware expert is usually online early morning european time, so there may not be a reply before tomorrow

dbrisendine · 2017-06-06T04:04:52.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[b] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/b]
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

Please close any other programs you are using and save your work / files. The FRST script will close all unneeded processes and then reboot the system (if needed) when finished.
- Right-click on
  https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
  icon and select
  https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
- Press the Fix button just once and wait.
- If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
- When finished FRST will generate a log on the Desktop, called Fixlog.txt.
  Please attach it to your reply.

How is your sytem now?

system · 2017-06-08T08:21:11.000Z

Thanks! Since the fix, Windows has asked me program-specific permissions to access the internet whenever I launch the program for the first time, but I haven’t had any more alerts from Avast. Looks like it worked.

dbrisendine · 2017-06-08T14:38:00.000Z

Can you post (attach) the Fixlog.txt file please? I would be interested in exactly what transpired.

system · 2017-06-08T18:47:15.000Z

Some of it is in Finnish. I’ve translated liberally.
Windowsin resurssien suojaus ei voinut suorittaa pyydetty„ toimintoa. = Windows resource protection could not execute requested action (This is maybe due to the file not existing there. I’ve looked several times too and it wasn’t there even though Avast kept reporting it so I guess something created it and Avast instantly quarantined it whenever that happened. I’ve no idea about these things.)
Windows IP-m„„ritykset = Windows IP definitions
DNS-tulkintatoiminnon v„limuistin tyhjent„minen onnistui. = Emptying the cache of the DNS interpreter function was successful.
Toiminto suoritettiin. = Successfully executed.

TrueIndian · 2017-06-09T02:51:48.000Z

Vernie,Wannacry can spread across a network if there is a vulnerable system.This means its crucial to do your updates.Maybe there is some computer on the network attacking your system because it isnt patched?

system · 2017-06-09T18:26:56.000Z

Thanks for the warning! There are no other devices in my network. As for updates however, the last time my PC managed to install Windows Updates was 12th of August 2016. I’m trying to update as we speak but it does what it usually does, which is being stuck at 0%. I probably should look into that somehow.

dbrisendine · 2017-06-10T04:53:20.000Z

Windows Update Repairs info and tools ==>> https://support.microsoft.com/en-us/help/971058/how-do-i-reset-windows-update-components

Announcements