Found Infected File, What should my next step be?

Viruses and worms
1

I’m using Windows 8, and I have the free version of Avast. I recently noticed that the black screen interface would pop up as a tab occasionally (it’s happened twice now, I don’t recall the first time it happened but it happened today, also sorry I’m not sure what the proper name for the black screen is, it’s where everything shows up as code.) My computer is running as normally with no other issues, but I scanned it and found that I had an infected file (WAXE53.tmp is the file’s name.) Avast said that it was changed at 6/17/15 at 6:45 pm, but I’m not sure if that’s implied when the file became infected or not. The virus Avast claims it is is a Win32:Evo-gen[Susp], which from what I gather is a generic term used by avast. How I got this virus is unknown to me, but if the 17th is the day I got the virus (which I’m not sure it is), then I do recall accidentally clicking on an email in spam, however I was there for less than a second and did not knowingly download anything.

I placed the infected file into the Avast ‘chest’, but what do I do now? I’ve currently running Malwarebytes Anti-Malware and hasn’t picked anything up so far and it’s almost finished scanning. I’m not sure if it’s not picking it up because I have it in the chest. Should I delete this file? How do I phsyically get rid of the virus? I appologize for not being very computer-savy or if I posted this in the wrong place ahead of time.

2

Hello,

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

3

Win32:Evo-gen[Susp] = Suspicious

4

What’s the next step?

EDIT: May I delete these programs you’re asking me to download afterward?

5

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyalltemp;
ipconfig /flushdns;b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

6

The website you posted to help me temporarily turn off the anti-virus doesn’t list any information on Malwarebytes Anti-Malware. How can I turn that one off?

EDIT: Nevermind, I think I’ve got both disabled.

7

So it’s been awhile, is this regular? I don’t mind the long wait, just asking.

8

Alright here you go. Am I able turn my anti-virus protection back on now?

9

TwinHeadedEagle is in European time zone, and it is way beyond midnight here, he will be back online tomorrow

10

Yes, you can re-enable your security software now. PC is clean now, how is it behaving?

11

It was slower than usual at first, but now it’s running normally.

Thanks a lot, you’re a life saver!