Hi,
For the past few hours Avast has been appearing in the bottom right of my screen with 2 Malware warnings and a Trojan horse. Avast says it is blocking these actions. Every 10 or so minutes the same message will appear. I have run Malware bytes with no luck. Does anyone have any suggestions?
http://img716.imageshack.us/img716/8129/log1n.png
-Jeff
Could you follow the steps in this thread http://forum.avast.com/index.php?topic=53253.0 and attach the logs here
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Database version: v2012.06.01.04
Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Jeff :: JEFF-LAPTOP [administrator]
6/7/2012 12:03:20 PM
mbam-log-2012-06-07 (12-03-20).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 471557
Time elapsed: 2 hour(s), 5 minute(s), 6 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\itunes.exe (Security.Hijack) → Quarantined and deleted successfully.
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 1
F:\Windows\Installer{88bb1660-41a0-e498-1e2b-b5977c0fd48a}\U\00000008.@ (Trojan.Dropper.BCMiner) → Quarantined and deleted successfully.
(end)
18:22:02.164 OS Version: Windows x64 6.1.7600
18:22:02.164 Number of processors: 8 586 0x2A07
18:22:02.165 ComputerName: JEFF-LAPTOP UserName: Jeff
18:22:03.956 Initialize success
18:22:05.014 AVAST engine defs: 12060700
18:22:07.173 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IAAStorageDevice-1
18:22:07.175 Disk 0 Vendor: WDC_WD32 02.0 Size: 305245MB BusType: 3
18:22:07.192 Disk 0 MBR read successfully
18:22:07.194 Disk 0 MBR scan
18:22:07.197 Disk 0 Windows 7 default MBR code
18:22:07.199 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
18:22:07.267 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 54748 MB offset 206848
18:22:07.275 Disk 0 Partition - 00 0F Extended LBA 250388 MB offset 112342550
18:22:07.297 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 250388 MB offset 112342613
18:22:07.332 Disk 0 scanning F:\Windows\system32\drivers
18:22:22.388 Service scanning
18:22:39.322 Modules scanning
18:22:39.332 Disk 0 trace - called modules:
18:22:39.698 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
18:22:39.706 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa8006fbc060]
18:22:39.712 3 CLASSPNP.SYS[fffff88001cb643f] → nt!IofCallDriver → [0xfffffa80046d3e40]
18:22:39.719 5 ACPI.sys[fffff88000f2f781] → nt!IofCallDriver → \Device\Ide\IAAStorageDevice-1[0xfffffa8004ace050]
18:22:40.192 AVAST engine scan F:\Windows
18:22:42.241 AVAST engine scan F:\Windows\system32
18:23:52.165 File: F:\Windows\assembly\GAC_32\Desktop.ini INFECTED Win32:Sirefef-PL [Rtk]
18:23:53.806 File: F:\Windows\assembly\GAC_64\Desktop.ini INFECTED Win32:Sirefef-PL [Rtk]
18:24:43.644 AVAST engine scan F:\Windows\system32\drivers
18:24:49.818 AVAST engine scan F:\Users\Jeff
18:33:51.411 AVAST engine scan F:\ProgramData
18:35:00.243 Scan finished successfully
18:39:06.258 Disk 0 MBR has been saved successfully to “F:\Users\Jeff\Documents\MBR.dat”
18:39:06.262 The log file has been saved successfully to “F:\Users\Jeff\Documents\aswMBR.txt”
18:45:16.182 Disk 0 MBR has been saved successfully to “F:\Users\Jeff\Documents\MBR.dat”
18:45:16.188 The log file has been saved successfully to “F:\Users\Jeff\Documents\aswMBR.txt”
Could you now run the OTL scan please
Here is the OTL.
OK I have the little blighter
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from “Start with Windows”
Reboot and then run OTL
http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:Files ipconfig /flushdns /c F:\Windows\Installer\{88bb1660-41a0-e498-1e2b-b5977c0fd48a} F:\Windows\assembly\GAC_32\Desktop.ini F:\Windows\assembly\GAC_64\Desktop.ini:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
THEN
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now