system
January 25, 2010, 3:39pm
1
Yesterday Avast! detected a suspicious file and some malware called Internet Security 2010 launched. After a quick Internet search, I downloaded Malwarebyte’s Anti-Malware from CNET and it detected and deleted several files and instructed me to reboot. Upon reboot, Internet Security 2010 appears to be gone.
However, Avast! now detects a suspicious file C:\WINDOWS\System32\Drivers\asc3550p.sys after each log in. I’ve deleted it, but it keeps coming back every reboot. After deleting it, Avast! says it has detected a virus in the operating memory and recommends doing a scan in the boot phase. I’ve already done this a couple times and the same thing keeps happening (it continues to detect the same suspicious file).
I have no idea how Internet Security 2010 got installed to begin with… and am not sure if I’ve still got a problem or if Avast! is just confused…
Thanks a lot for your assistance and let me know if you have any questions,
S.P. Gass
system
January 25, 2010, 3:52pm
2
Hi spgass, welcome to the forum
http://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010
For those that will try to help (I am of no real help here sorry)
Could you please post the MBAM scan log?
It may also be a good idea to follow essexboy’s advice, one of our resident malware experts… http://forum.avast.com/index.php?topic=53253.0
-Scott-
Pondus
January 25, 2010, 3:58pm
3
...(Wow I sound like I know what I am talking about... )
.... :D I am using the same trick Scott.......and no one complains ..... ;D
system
January 25, 2010, 4:18pm
4
Log from last night’s scan:
Malwarebytes’ Anti-Malware 1.44
1/24/2010 7:28:44 PM
Scan type: Quick Scan
Memory Processes Infected: 2
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
system
January 25, 2010, 5:26pm
5
Just ran it again and got:
Malwarebytes’ Anti-Malware 1.44
1/25/2010 12:03:10 PM
Scan type: Quick Scan
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
system
January 25, 2010, 5:40pm
6
That was found in the last scan also…it looks like it keeps returning…I think that essexboy may need a look at this…hit it with a stronger tool…
In the meantime it may be worth running OTL as outlined in the thread I mentioned, to prepare for essexboy…
-Scott-
Pondus
January 25, 2010, 6:11pm
8
Malwarebytes have been updatet since your scan
system
January 25, 2010, 8:48pm
9
OK, ran the updated version. Seems to keep finding the same thing after delete & reboot:
Malwarebytes’ Anti-Malware 1.44
1/25/2010 3:47:11 PM
Scan type: Quick Scan
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
On completion of this run let me know if MBAM still reports the registry entry
Run OTL.exe
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
[2010/01/24 19:12:41 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\18467.exe
[2010/01/24 18:57:15 | 00,000,756 | ---- | M] () -- C:\Documents and Settings\Gass\Desktop\Internet Security 2010.lnk
[2010/01/24 18:47:29 | 00,000,001 | ---- | M] () -- C:\s
:Commands
[purity]
[emptytemp]
[*]Then click the Run Fix button at the topdon’t check the boxes beside LOP Check or Purity this time )
Does MBAM show the registry key now after the OTL fix ?
system
January 25, 2010, 10:23pm
13
OK, I ran the FIX as specified, rebooted and ran another quick scan. I unchecked the two boxes as it was running and attached the logs. Let me know if I didn’t do anything right.
Could you now run a quick scan with MBAM to see if the entry has disappeared
system
January 25, 2010, 11:01pm
15
Still there unfortunately. I really appreciate your help!
In that case it is time for the big boy to find the driver/respawner responsible
Download ComboFix from one of these locations:
Link 1 Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
[*]Double click on ComboFix.exe & follow the prompts.
[*]As part of it’s process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it’s strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
system
January 25, 2010, 11:43pm
17
OK, I turned off Avast and ran ComboFix. Here’s the log.
system
January 26, 2010, 1:31am
18
I reran MBAM and it didn’t find anything. Does this mean I’m cured?
Windows 5.1.2600 Service Pack 3
1/25/2010 8:27:11 PM
Scan type: Quick Scan
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Combofix killed the file and removed the legacy keys ;D
Run OTS and hit the cleanup button then all the tools should disappear
system
January 27, 2010, 2:18am
20
Essexboy, you rock!
Thank you, thank you, thank you!
Best Regards,
S.P. Gass
