I have contracted the trkjmp virus - All logs posted

Viruses and worms
1

Hi first time using these forums, so please bear with my lack of familiarity with how things are done around here ::slight_smile:

I ran MBAM and not only did it not get rid of the problem, it didn’t even find a problem.
Starting from the moment I post this, I am following the steps outlined in this thread: http://forum.avast.com/index.php?topic=53253.0

I will attach the log from AdwCleaner here as soon as I run it and obtain the log following reboot!

Edit: I am running Windows 7 Home Premium, and the problem occurs when I load webpages in Chrome. Hope that helps some

2

Had to fix my computer so that it stopped trying to open .txt files with cmd.exe… Boy was that a pain in my ass.

Anyway: AdwCleaner log attached!

Will work on getting the MBAM log next.

3

Once again, my MBAM did not detect any infected files.

Still, I have attached the MBAM log.

Moving on to OTL.

4

Alright, the OTL and Extras logs are now attached.

Next up is aswMBR

5

Alright, the moment of truth (actually that would probably be the testing of any sort of solution to this problem. Alas, I digress)

Attached is the aswMBR log.

I am in your capable hands, avast moderator peoples

6

It may or may not be worth mentioning that the pop-up that avast! has blocked this particular virus no longer pops up. Others dealing with this issue have noticed this as well. I’m worried that means that it found a way around avast! or something :o

7

Hi Sightseek3r,

A certified volunteer malware removal expert has been notified.

You should see new activity on your post within a few hours. Logs are needed to see the malware, what it is, where it is, and how best to proceed. You will be in good hands, but please be patient as the person contacted likely lives in another time zone than you do.

8

I would still love some help with this problem. I was reading other posts by people with the same problem as mine and they similarly noticed that the avast! pop-up was no longer appearing. However, the trkjmp URL:Mal was still appearing in the active shields

9

seems they have missed your post … i will send them a PM so they see it when they arrive

10

My apologies for missing you, I thought I had replied…

First could you confirm that it is Chrome only

If so could you run Chrome in incognito mode… And check to see if they have gone http://support.google.com/chrome/bin/answer.py?hl=en&answer=95464

11

By they, do you mean the avast! notification pop-ups? Because they already stopped appearing a couple days ago, even in regular Chrome. Is there another way to check whether avast! is still blocking the trkjmp virus if it doesn’t give me pop-ups anymore?

12

That was in part a false positive, the domain is owned by amazon but it had a subdomain with crossrider. Avast is now only blocking the sub domain. And there is no indication of crossrider on your system. Almost everyone else had it though

But you look clean

13

Not to second guess you but are you sure?

14

Yes as we had a surge of them over the weekend, and I think it was only three that did not have crossrider and the alerts ceased for those when Avast updated (You were one of them)

15

Great! Thanks for the help then :slight_smile:

16

Not a problem, I was quite busy that day

Run OTL and press the cleanup button to remove it