Avast malfunctions and maybe trojans!.

Viruses and worms
21

More data:
Yesterday my Avast started working again. And i cannot stop its processes. Not uninstall it. The only thing i could do was to stop the access scanner for a while. And i know that the software consumes many resourses and connects to different countries. I know this As I have the TCP viewer and the nextat agent. I know some malware is made to be undectectable because by using packers or binders it’s malicious code can be masquerade. So i had the RGD Packer that is supposed to unpack packed malware to make it detectable. I used this some days ago and I think I made something wrong because it changed the names of lots of folders to ZZZZZZ.ZZZZZ. Another thing that happened is that old files that I deleted some time ago, reappeared on my desk but even if i have an application to make the files that are hiden by malware or virus activity, visible again there is no way I can change the attribute of hidden of such fiels nor get rid of them. And before getting into this forum as my avast antivirus has crushed and stopped working properly I made and online scan with a soft called pcsafedoctor and detected some trojans and a backdoor but when I was going to delete them it gave me an alert saying that I had to pay to delete them and I have no money so here I am. On another hand I know who hacked me It was a guy that was a friend of mine that became my worst enemy. He said he was a hacker but I didn’t believe him untill he took revenge on me and started cyberbullying me. A guy tried to help me and instaleld the AVAST here it killed some trojans and thanks god the cyberbullying stopped but the pc remains still captured as my cursor moves alone and many unknown files and processes run without my permission. And my disk suddenly started loosing space being filled up with I dont know what, and the pc is terribly slow.
Thanks in advance.
Epona.

PD: I had to split the log of the Combofix as it was too long. :slight_smile:

22

@ Epona
It is much simpler to just attach the log file to your post. You don’t have to break it into many parts ans it makes it easier for essexboy to read it in that attachment than spread over two pages of the topic.

When using the Reply button, click the Additional Options to attach the file (.txt or .log files and up to 200KB).

If you do that now, it will make life a lot easier for essexboy and we will try and clean-up the other posts.

23

I think I will need to run a deeper analysis for this one

At the end I will ask you for a Zip file - that will need to be uploaded to Mediafire and the sharing link posted here

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

Click the cog in the upper right

http://i1224.photobucket.com/albums/ee362/Essexboy3/AVP%20shots/AVPfront.gif

Select down to and including your main drive, once done select the Automatic scan tab and press Start Scan

http://i1224.photobucket.com/albums/ee362/Essexboy3/AVP%20shots/avpsettings.gif
]

Allow AVP to delete all infections found
Once it has finished select report tab (last tab)
Select Detected threats report from the left and press Save button
Save it to your desktop and attach to your next post

Now the Analysis

Rerun AVP and select the Manual Disinfection tab and press Start Gathering System Information

http://i1224.photobucket.com/albums/ee362/Essexboy3/AVP%20shots/AVPAnalysis.gif

On completion click the link to locate the zip file to upload and attach to your next post

http://i1224.photobucket.com/albums/ee362/Essexboy3/AVP%20shots/AVPZiplocation.gif

24

Umm, nice images ;D

25

Pretty aren’t they ;D

26

TDSS ones captured and on their way.

27

Hi guys here are the logs of the kaspersky virus removal tool and the avp tool and the info you asked for:
http://www.mediafire.com/?qa111wo48o3yo

28

Oh by the way… the OTL file of the link you provided was infected and the english one of the versions of the virus removal tool you gave me is corrupted. I think it’s in spanish the other file in english is fine but had soms processing errors.

29

Epona please hide your email unless you want your address harvested by spammers.

30

Once you have done this run could you run a new OTL log for me please

[*]Re-run AVPTool
[*]Select the Manual Disinfection tab and press Script execution

http://i1224.photobucket.com/albums/ee362/Essexboy3/AVP%20shots/avpmanual.gif

[*]Where it states Insert text script in the following box copy the below script and press Run script
Copy from Begin until End

http://i1224.photobucket.com/albums/ee362/Essexboy3/AVP%20shots/avpscript.gif

begin
SetAVZPMStatus(True);
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 DeleteFile('C:\Archivos de programa\PCSafeDoctor\pcsafedoctor.exe');
 BC_DeleteFile('C:\Archivos de programa\PCSafeDoctor\pcsafedoctor.exe');
BC_ImportDeletedList;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

[]Your system will reboot on completion, if it does not please do so yourself
[]On completion please run another analysis scan and attach the zip file

31

My avast scanner repeatedly detected Helios Trojan but repeatedly failed to remove it.I’m not sure my computer can recover without sending it to toshiba

32

lillispicegirl could you start your own topic after following the instructions here please http://forum.avast.com/index.php?topic=53253.0

33

lillispicegirl - create your new topic, here http://forum.avast.com/index.php?board=4.0 in the viruses and worms forum and click the New topic button at the top of the page see image and we will try and help you there.

34

Here goes the log you asked for David:
http://www.mediafire.com/?g4cf3puf9o5j8

35

It may not be required for this topic now as essexboy decided to do a deeper scan using the AVPTool, which you did. So events have overtaken that request.

36

Ok DavidR I suggest you or Essexboy to check up that logs because I’m still in trouble. I have some files that couldn’t be processed as are blocked or under a password. The blocked ones I cannot unlock them. My cursor still moves alone and my Avast antivirus had so many mistakes that I was even thinking of repairing it or reinstall it.
:slight_smile:

37

The password files are not a problem as they are inert unless run

What errors is Avast giving

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL DRV - File not found [Kernel | Unknown | Running] -- -- (uteznzew) DRV - File not found [Kernel | Disabled | Stopped] -- -- (ultra) DRV - File not found [Kernel | Unknown | Stopped] -- -- (ujeznzew) DRV - [2011/08/26 17:19:48 | 000,011,264 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\uzeznzew.sys -- (uzeznzew) IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = CB C3 E0 07 00 7D D2 49 B6 89 61 39 66 DA 71 57 [binary data] IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = CB C3 E0 07 00 7D D2 49 B6 89 61 39 66 DA 71 57 [binary data] IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = CB C3 E0 07 00 7D D2 49 B6 89 61 39 66 DA 71 57 [binary data] IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = CB C3 E0 07 00 7D D2 49 B6 89 61 39 66 DA 71 57 [binary data] IE - HKU\S-1-5-21-1417001333-115176313-1177238915-500\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = CB C3 E0 07 00 7D D2 49 B6 89 61 39 66 DA 71 57 [binary data] O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found. [2011/08/26 17:19:48 | 000,011,264 | ---- | C] () -- C:\WINDOWS\System32\drivers\uzeznzew.sys [2011/08/26 14:10:04 | 000,647,744 | ---- | C] () -- C:\HF_1.00.01.0002.exe [2011/08/26 14:06:08 | 000,443,448 | ---- | C] () -- C:\Hotfix_1.00.01.0002.exe

:Reg
[HKU.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-
[HKU\S-1-5-21-1417001333-115176313-1177238915-500\SOFTWARE\Microsoft\Internet Explorer\Main]
XMLHTTP_UUID_Default=-

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

38

Hi this are the logs of the avast errors:

39

Could you now run a repair of Avast please and then let me know of any further problems

40

Hi boys: Things got a little better, my pc is a bit faster and doesnt crush as often as it did before but it still remains hacked and I have windows problems. I also have files that runs without my permission and try to eliminate other files like this one: NDP20SP2-KB979909-x86.exe. Or NDP20SP-KB9799. How do I repair the AVAST?. And by the way some AVAST processes runs many times at once like the AShweb process and i cannot stop them. They take many resources of my pc.