It started about a week ago. It comes up randomly. Sometimes it will or wont come up. For example: it will come up if I open Internet Explorer or Mircosoft Word, or any other program on my computer, sometimes Skype as well. Then it says do a boot-scan right after it disapears or I click off of it.
It does ot on its own. I have reported it false many times, but it keeps showing up and sometimes prevets things from opening right away because of it. I have scan with diff softwares including Avast over and over and I do the boot-scan, but it keeps happening.
Does anyone know what this is or how to help? I will provide more in-depth details if needed. Also a side note: it all derives from one file that apparently can only be found in avast, because when I go to the actual folder, I cant find it or maybe I’m going to the wrong thing. Thanks in advance!
But the all derive from the same source: C:\Windows\assembly\tmp\U\80000032.@
I don’t believe this is a false positive but the noaccess (if I remembered the name correctly) malware - This needs further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware. Use the information about getting and using the logs and start your own new topic and attach the logs there, not in the LOGS topic.
Obviously you won’t have to run the aswMBR tool again. From my limited knowledge of this tool it looks clean. So if you post the other OTL logs, etc. we can have someone take a look at them.
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
It will not let me upload the OTL file. Every time I place it in there for the Browse option and click post it clears it. It is under the allowed KB, I dont know why it wont post.
Use the Additional Options link in the Reply window, that will let you attach your OTL log file/s if they are under 200KB. If larger then they can be uploaded to a file share site:
OK, you will be playing a bit of time zone ping pong, it is now 2:42am in the UK so essexboy will be in bed now. He should be back on-line later this evening.
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
Everything seems to be fine now. I will let you know if anything occurs in teh next few days or so. Thanks a lot. Do I need to continue to keep the Combo Fix on my desktop or can I delete it? Also, is there any way to avoid this from happening again, since Avast couldn’t stop it the first time?
Could you open Avast
Select the virus chest
Right click in the blank space and select add
Navigate to c:\Qoobox\c:\windows\system32\consrv.dll
Select that file and then once it is in the chest
Right click and select send to virus labs
Fill in the form and select potential malware
Manually update Avast to send it
If all is well tomorrow - let me know and I will remove my tools
Everything seems to be back to normal. The only thing I notice is that when run a full scan with Avast, it still pops as they found it even though I am no longer having any problems with anything. I assume this is normal? If so, I believe everything else is fine and I am ready to remove your wonderful tools.
No I am no longer getting the detections. Its just when I run the standard full scan with Avast, it comes up as one of the threats when it is finished.
I have none of the same problems I had before you helped me, it just shows up in the Avast, ONLY when I run a quick or full scan.
Here are the files that show up - C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir
and the other is - C:\Windows\assembly\tmp\kwrd.dll
Other than it showing up in the scan, as far as I can tell everything with my computer runs just fine.
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
