.bat Virus keeps coming back.

Viruses and worms
1

Hello!
for about 1-2 weeks, avast has blocked a virus called: .bat.
I put it in the virus chest, but it keeps coming back.

Its located in my appdata folder, in local and temp.
The name of the virus is “package” or something similar, and is a .bat file that tries to run on my pc, but avast blocks it.
I have cleaned the appdata folder many times, but it keeps coming back.
When i do a full scan, no virus is found.

Somehow, it keeps coming back, its like it copies itself from another location. Please, how can i delete this virus for good?

Here is a screenshot of my current viruschest:

https://gyazo.com/13a9dc1f976a6a76e1e4902930ae8c4e

2

Attach your basic diagnostic logs. (MBAM and FRST)
Instructions: https://forum.avast.com/index.php?topic=194892

3

According to malware bytes, it found over 500 threats. God damn, i hope the files i attached can help you guys help me…Before something bad happens. Thanks !

4

I couldn’t remove the threats in malwarebytes, (did not find a button that said remove) but i could send them to the quarantine. And i did.

5

What It Means to Quarantine, Delete, and Clean Malware >> https://www.lifewire.com/clean-quarantine-or-delete-3972276

6
  • Open Notepad (click Start button → type notepad.exe → press Enter)
  • Copy text from code block below and paste it into Notepad
Task: {C46A09FE-D9CE-4172-9C2B-D52504A25E25} - System32\Tasks\svchostc => C:\Users\Tobia\AppData\Local\svchostc\svchostc.exe [2018-06-25] () <==== ATTENTION
VirusTotal: C:\Users\Tobia\AppData\Local\svchostc\svchostc.exe;
C:\Users\Tobia\AppData\Local\svchostc
C:\USERS\TOBIA\APPDATA\LOCAL\SVC10.17134
EmptyTemp:
  • Go to File → Save As
  • Make sure that UTF-8 is selected as Encoding (left side of Save button)
  • Save it as fixlist.txt on Desktop
  • Open again FRST and click on button Fix
  • Wait until FRST finishes
  • fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.
7

Done.
i appreciate your time and help. Thanks!

8

What is system status now?

9

No more popup alerts from Avast,
And the laptop feels much more stable. I think the virus is gone,
Thanks for all the help, you guys rock ! :slight_smile:

10

Rename FRST64.exe to uninstall.exe and run it. That should unisntall FRST.