Hello. I get a message saying that
“Trojan horse blocked
Object: C:\Users\username\AppData\Local\Temp\iswizard\wuaudit.exe
Infection: Win32:Crypt-OSW[Trj]
Action: Moved to chest
Process: C:\Windows\System32\rundll32.exe”. It pops up repeatedly.
What should I do to clean it? Thanks for help.
Please attach your logs. (AdwCleaner, MBAM, OTL and aswMBR…!!)
Instructions: http://forum.avast.com/index.php?topic=53253.0
Adwcleaner log
Mbam log
Otl log1…2
Aswmbr
Mbam
Again attached
Looks like MBAM has finally found the trigger file… On completion of this run could you let me know if the alerts cease
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:Files
C:\Users\dell\AppData\Local\Temp\iswizard
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.