My avast is infected by a virus

system · September 23, 2007, 3:32pm

Help!! I was trying to download a file from what I now know is a website with ‘suspicious’ downloads provided by private users, and my avast started going crazy with warnings. End result; after I rebooted as avast suggested and allowed avast to run a thorough scan during the reboot, I’m getting this message that prevents avast from running:

[b]avast!Warning

avast! detected unauthorized modification of this program file (C:\Program Files\Alwil Software\Avast4\ashAvast.exe)[/b]

During the reboot scan, avast gave me the choice of deleting, moving, or ignoring the infected files. Every time I chose ‘move’ I received the warning that the file was ‘in Windows’, but chose to move it anyhow.

Otherwise my pc seems to be running normally. What do I do now, please? I hate being online without protection.

Thanks in advance.

essexboy · September 23, 2007, 3:36pm

Have you tried a repair of Avast ?

Go to control panel > add/remove programmes >select Avast then select repair

system · September 23, 2007, 3:41pm

Thanks much, essex. Just did as you suggested and will reboot in a minute as advised. I’ll let you know.

system · September 23, 2007, 3:53pm

Okay; I did the repair to avast and then rebooted, but am still getting the same error message. Avast has just asked me to reboot again so I’ll do so. I’ve also reported the virus to avast in the meanwhile.

essexboy · September 23, 2007, 3:54pm

Once you have Avast back up and running I will check your system for problems if that is OK

Click here to download HJTsetup.exe

[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

system · September 23, 2007, 4:13pm

Okay essex; did as you instructed. I’ve copied the logfile as follows (it’s pretty lengthy):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:57 AM, on 9/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Omniquad Total Security\MyPrivacy\mpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\ProSaver Screensaver Manager\ProSaver.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ttlg.com/forums/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: XTTBPos00 - {055FD26D-3A88-4e15-963D-DC8493744B1D} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\jkkhfda.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 “EPSON Stylus CX4800 Series” /O6 “USB002” /M “Stylus CX4800”
O4 - HKLM..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvloc.dll,startup
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: ProSaver.lnk = C:\Program Files\ProSaver Screensaver Manager\ProSaver.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm082MFUS
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra ‘Tools’ menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15-3.cab
O16 - DPF: {72C9EA8F-8965-40C2-ABAD-D460A5815F86} (hostCntrlIE Class) - http://host-d.oddcast.com/hostClientIE.cab
O17 - HKLM\System\CCS\Services\Tcpip..{7CA00AE6-702E-42F0-BB65-C8E1E3CBE0C5}: NameServer = 68.94.156.1 68.94.157.1
O20 - AppInit_DLLs:
O20 - Winlogon Notify: jkkhfda - C:\WINDOWS\SYSTEM32\jkkhfda.dll
O20 - Winlogon Notify: winzzc32 - C:\WINDOWS\SYSTEM32\winzzc32.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Omniquad MyPrivacy - Unknown owner - C:\Program Files\Omniquad Total Security\MyPrivacy\mpsvc.exe

–
End of file - 6090 bytes

Thanks for your help. Hope you can find whatever is mucking up my avast.

essexboy · September 23, 2007, 4:17pm

The cavalry is on its way, 5 minutes to start the fix ;D

essexboy · September 23, 2007, 4:25pm

Here we go Dia

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. [b]

O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\jkkhfda.dll
O4 - HKLM..\Run: [CTDrive] rundll32.exe C:\WINDOWS\system32\drvloc.dll,startup
O4 - HKLM..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15-3.cab
O16 - DPF: {72C9EA8F-8965-40C2-ABAD-D460A5815F86} (hostCntrlIE Class) - http://host-d.oddcast.com/hostClientIE.cab
O20 - Winlogon Notify: jkkhfda - C:\WINDOWS\SYSTEM32\jkkhfda.dll
O20 - Winlogon Notify: winzzc32 - C:\WINDOWS\SYSTEM32\winzzc32.dll

[/b]Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Please download the OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\lsasss.exe
C:\WINDOWS\system32\drvloc.dll
C:\WINDOWS\system32\jkkhfda.dll
C:\WINDOWS\SYSTEM32\jkkhfda.dll
C:\WINDOWS\SYSTEM32\winzzc32.dll

Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new Hijack log.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

FINALLY

Please download VundoFix.exe to your desktop

[*]Double-click VundoFix.exe to run it.
[*]Click the Scan for Vundo button.
[*]Once it’s done scanning, click the Remove Vundo button.
[*]You will receive a prompt asking if you want to remove the files, click YES
[*]Once you click yes, your desktop will go blank as it starts removing Vundo.
[*]When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:[b]vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from “Click the Scan for Vundo button” when VundoFix appears upon rebooting.

If you could provide the following logs please Vundofix, OTMoveit and a new Hijackthis

system · September 23, 2007, 4:30pm

Hi essexboy ;D

Sorry i am jumping in the thread for a bit have them check for AWF too, i see couple of signs in there.

Regards

essexboy · September 23, 2007, 4:31pm

No probs my love just trying to clear the main first - have sasser as well

system · September 23, 2007, 4:51pm

Ok; checked the boxes you instructed essex; however, while running the ‘fix checked’ I automatically got this error message:

Error Details:
An unexpected error has occurred at procedure: modBackup_MakeBackup(sltem=O20 - Winlogon Notify: jkkhfda - C:\WINDOWS\SYSTEM32\jkkhfda.dll)
Error #53 - File not found

I reran the scan and rechecked those items you’d specified and now am left with just the ‘O2 - BHO: (no name) - {837B45D6-BF85-457D-AABF-6D2E7815F791} - C:\WINDOWS\system32\jkkhfda.dll’
and ‘O20 - Winlogon Notify: jkkhfda - C:\WINDOWS\SYSTEM32\jkkhfda.dll’ that continue to generate error messages.

Shall I continue with the rest of your instructions anyway?

essexboy · September 23, 2007, 4:52pm

Yes please

system · September 23, 2007, 5:53pm

Allrightythen; did the copy/paste of the OTMoveIt files, ran that program, then reran HiJack This, received a generic error message that wanted me to either send a report of the error or don’t send & a notebook copy of the HJ scan refused to open. Had to reinstall HiJackThis, rescanned and below are the results of the scan. Also, the Vundo program caused not only an avast virus present warning message to show on my screen (it claims it was in the Vundo program), but immediately wanted to shut everything down to the point where the only option I had left was to do a hard reboot. I still keep getting the error message when avast tries to open upon bootup and if I keep clicking yes - start anyway, I get the message that avast wants to shut down and reboot my system. Would it just be easier to remove avast and do a completely new install from avast on-line?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:42:51 PM, on 9/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Omniquad Total Security\MyPrivacy\mpsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\GetRight\getright.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\ProSaver Screensaver Manager\ProSaver.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ttlg.com/forums/
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRA~1\ICQTOO~1\toolbaru.dll
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 “EPSON Stylus CX4800 Series” /O6 “USB002” /M “Stylus CX4800”
O4 - HKLM..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: ProSaver.lnk = C:\Program Files\ProSaver Screensaver Manager\ProSaver.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZUxdm082MFUS
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra ‘Tools’ menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip..{7CA00AE6-702E-42F0-BB65-C8E1E3CBE0C5}: NameServer = 68.94.156.1 68.94.157.1
O20 - AppInit_DLLs:
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Omniquad MyPrivacy - Unknown owner - C:\Program Files\Omniquad Total Security\MyPrivacy\mpsvc.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Unknown owner - VundoFixSVC.exe (file missing)

–
End of file - 5254 bytes

P.S. Just noticed my Windows Media player won’t open. Does this mess have anything to do with that?

Maxx_original · September 23, 2007, 5:58pm

the files related to Vundo are described by others above… but - Vundo isn’t a file infector and doesn’t modify avast files… some part of the malware in your computer downloaded probably a new modification of Virut, that is not yet detected by avast (i’m working on it)… the other thing is, that we must make some better detection of Vundo, but it’s hard to do, cause Vundo has too high frequency of releasing new versions… anyway - there’s a possibility to make a reliable detection for it and we will do it…

system · September 23, 2007, 6:04pm

Hi and sorry i am hijacking the thread

Please follow this steps:

Download FindAWF.exe from here or here, and save it to your desktop.

[]Double-click on the FindAWF.exe file to run it.
[]It will open a command prompt and ask you to “Press any key to continue”.
[*]You will be presented with a Menu.

Press 1 then Enter to scan for bak folders
Press 2 then Enter to restore files from bak folders
Press 3 then Enter to remove bak folders
Press 4 then Enter to reset domain zones
Press E then Enter to EXIT
[*]Press 1, then press Enter
[]It may take a few minutes to complete so be patient.
[]When it is complete, it will open a text file in notepad called AWF.txt.
[*]Please copy and paste the contents of the AWF.txt file in your next reply.

Regards

system · September 23, 2007, 6:34pm

Hi Claudia :

  Sometimes Malware can hide from "hijackthis.exe", so to prevent that
  possibility, it is advised to "Rename" it to something else, like 
 "hijackClaudia.exe"; then when you run the HijackThis program, any thing
  that was "hiding" will most likely be "exposed" . The ONLY thing renamed
  is the "exe" .

system · September 23, 2007, 7:48pm

Thanks Snowhite; I couldn’t use your links, but managed to find a copy of FindAWF.exe. After entering 1, the program ended up opening notepad with the following message. I never made it to step 2.

The current date is: Sun 09/23/2007
The current time is: 14:44:58.06

bak folders found



Directory of C:\PROGRA~1\MESSEN~1\BAK

             0 File(s)              0 bytes

Directory of C:\PROGRA~1\STORAG~1\BAK

             0 File(s)              0 bytes

Directory of C:\PROGRA~1\TASKPLUS\BAK

10/01/2003  08:11 PM         3,841,536 taskplus0.exe
             1 File(s)      3,841,536 bytes

Directory of C:\WINDOWS\SYSTEM32\BAK

08/04/2004  02:56 AM            26,624 ctfmon.exe
             1 File(s)         26,624 bytes

Directory of C:\PROGRA~1\ALWILS~1\AVAST4\BAK

01/15/2007  12:28 PM           108,160 ashDisp.exe
             1 File(s)        108,160 bytes

Directory of C:\PROGRA~1\ROXIO\EASYME~1\DRAGTO~1\BAK

06/24/2004  02:47 PM         1,691,648 DrgToDsc.exe
             1 File(s)      1,691,648 bytes

Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK

02/01/2005  02:00 PM           110,592 E_FATIADA.EXE
             1 File(s)        110,592 bytes


Duplicate files of bak directory contents

3841536 Oct 1 2003 “C:\Program Files\TaskPlus\bak\taskplus0.exe”
92672 Aug 4 2004 “C:\WINDOWS\system32\ctfmon.exe”
26624 Aug 4 2004 “C:\WINDOWS\system32\bak\ctfmon.exe”
108160 Jan 15 2007 “C:\Program Files\Alwil Software\Avast4\ashDisp.exe”
108160 Jan 15 2007 “C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe”
1691648 Jun 24 2004 “C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\bak\DrgToDsc.exe”
110592 Feb 1 2005 “C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_cx4800f6be\E_FATIADA.EXE”
110592 Feb 1 2005 “C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\E_FATIADA.EXE”

end of report

system · September 23, 2007, 8:01pm

ClaudiaHorn,

Thanks for letting me know about the not working links

You have a downloader trojan called Downloader.Agent.awf or Downloader.Agent.ayy. This trojan replaces legitimate files that are common on most computers with an infected file. It then moves the legitimate file to a “bak” or backup folder. I will post new instructions to you soon as possible.

system · September 23, 2007, 8:05pm

seeing as this virus attacks Avast files surely this should be a high priority in terms of producing a signature for it or changing Avast to become immune, is this the case or will it be down to luck as to whether you get infected by it?

essexboy · September 23, 2007, 8:28pm

Thanks Snezana my wife pinched the system

My avast is infected by a virus

Announcements