Avast repeatedly finds malware on my PC

Viruses and worms
1

Hi everyone. I recently installed Avast to help protect my computer against viruses, etc. after MSE found my PC to be at risk. Avast seems to be working well, but it repeatedly detects malware on my PC. Could I get any suggestions on how to remove this repetitive malware? Thanks in advance.

2

follow this guide and attach (not copy and paste) logs from Malwarebytes / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0

3

Okay, attached are the logs from Malware Bytes, OTL, and aswMBR.

4

[list]Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application

http://dl.dropbox.com/u/73555776/TDSSFront.JPG

[*]Then click on Change parameters.

http://dl.dropbox.com/u/73555776/TDSSConfig.JPG

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

[*]Click the Start Scan button.

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

http://dl.dropbox.com/u/73555776/TDSSFound.JPG

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

[*]Get the report by selecting Reports

http://dl.dropbox.com/u/73555776/TDSSEnd.JPG

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

Please copy and paste its contents on your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

5

Hi essexboy, I’ve followed the steps you posted and have run ComboFix. After ComboFix rebooted my PC, it started running rapidly with windows opening and closing very quickly. Is this normal behavior or is this another problem?

6

after combofix run you may reboot twice…see if that change it

7

Could you attach the combofix log… Are the windows that open undemanded or is it just the the system speed has improved ?

8

The problem is, ComboFix never produced a log because after rebooting my PC, it kept opening and closing a “cmd looking” window for hours (not improved PC speed). I do have the report from TDSSKiller, however. What shall I do now?

9

And yes, undemanded windows. But I am unsure if this behavior is normal for ComboFix after it automatically reboots my PC.

10

Could you attach the TDSSKiller log please and run an all users OTL scan… I will stop the combofix commands and try to determine the problem

11

Okay, running OTL again now. Attached is the TDSSKiller log.

12

Here is my latest OTL log.

13

OK lets get at it

Re-run TDSSKiller and when the following is shown select delete:

\Device\Harddisk0\DR0 ( TDSS File System )

THEN

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL O3 - HKU\S-1-5-21-2379839073-4071701647-4284832647-1004\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-2379839073-4071701647-4284832647-1004\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKU\S-1-5-21-2379839073-4071701647-4284832647-1006\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-2379839073-4071701647-4284832647-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [combofix] C:\ComboFix\CF3956.3XE (Microsoft Corporation) O4 - HKLM..\RunOnce: [combofix] C:\ComboFix\CF3956.3XE (Microsoft Corporation) O4 - HKLM..\RunOnceEx: [flags] Reg Error: Invalid data type. File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present [2012/08/04 15:57:46 | 000,000,000 | --SD | C] -- C:\ComboFix [2011/04/17 17:12:30 | 000,011,518 | -HS- | C] () -- C:\ProgramData\1u0ht75dqlgd1e6l07o0sy6qerxj [2011/04/09 16:57:58 | 000,001,300 | -HS- | C] () -- C:\ProgramData\m6u715kk60n

:Files
ipconfig /flushdns /c
C:\Windows\SysWOW64\config\systemprofile\AppData\Local{c88b160f-bff3-e463-7510-f7164b2d1748}
C:\Windows\System32\config\systemprofile\AppData\Local{c88b160f-bff3-e463-7510-f7164b2d1748}
C:\Users\Troy.michael-PC\AppData\Local{c88b160f-bff3-e463-7510-f7164b2d1748}

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

FINALLY

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

14

Hi essexboy, I followed all the steps above up until ComboFix automatically rebooted my PC. That was all done in Safe Mode. I started up my PC in Normal Mode and find myself with the same issue (ComboFix cmd windows rapidly opening and closing). No log has been produced upon reboot, either. What shall I do now?

15

OK from safe mode we will uninstall combofix. Once done then run a fresh OTL scan for me please and let em know what problems we still have

Remove ComboFix

[*]Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
[*]In the Run box, type in ComboFix /Uninstall (Notice the space between the “x” and “/”) then click OK

http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg

[]Follow the prompts on the screen
[]A message should appear confirming that ComboFix was uninstalled

16

Should I run the fresh OTL scan in Safe Mode? Also, any specifics on running the OTL scan?

17

Normal mode for OTL please … Make sure all users is selected ;D

18

Sorry, another question. Any specific scripts to include? Also, would you like me to attach the log after completion?

19

No just a normal scan and then attach

20

Attached is the latest OTL scan. So, am I malware free?