Hi, I’m an avast user and I’m here because I recently seem to have contracted several viruses, and I’d like some advice on how to identify and remove them. I run Windows XP SP3, and I have avast v.5.0.594 with virus definition version 100911-1.
This happened on September 11th, 2010. I was browsing through a couple websites that I visit very frequently, when I suddenly got 3 alerts from avast saying that it had blocked some malicious actions. Immediately afterward, It moved 41 files to the virus chest. Most of the files moved to the chest were .sys files from C:\Windows\system32\drivers, and they were labeled Win32:Bubnix-J[Rtk]. The rest were Labeled VBS: Malware-gen, and included a few .tmp files, such as ~TM11.tmp and ~TM1F.tmp, from C:\WINDOWS\TEMP, and 3 of the same file: fjhdyfhsn.bat, from C:\WINDOWS\system32. I ran a full system scan with avast, and it turned up nothing after that. I then ran a boot-time scan, and that found nothing. However, as soon as I opened Firefox again (the only web browser I use), I got several more alerts from avast and several more files were moved to the virus chest.
My computer began to act strangely. It ran much slower, it hangs for several minutes after startup so that I can’t see the task bar or bring up the task manager, the cpu was unusually busy (about 50%), and the computer stopped recognizing my USB flash drive. I downloaded, installed and updated several more security programs (avast was originally the only one I had on the computer) and disconnected my computer from the internet.
Malwarebytes’ Anti-Malware found a file called avdrn.dat (C:\Documents and Settings*My User Name*\Application Data\avdrn.dat) and marked it as Malware.Trace before deleting it. I have not seen it since.
After that, a suspicious application appeared in my Startup folder called monmvr32.exe, and that process apppeared in the task manager. Avira Anti-virus detected that it contained something called “TR/PSW.LdPinch.apky” and deleted it. I have not seen it since then.
After that, I ran Ad-Aware. As soon as the program started, it said that it had detected a malicious process and would scan it in background mode. It detected something called Win32.Backdoor.Papras/A, which I understand is a Trojan? In any case, I did whatever Ad-Aware’s “recommended” action was, but when I scanned again, the same item was detected again. Ad-Aware said that it was associated with C:\WINDOWS\system32\bootpart.dll. I have refrained from deleting, quarantining, etc. that file as I don’t know what it is or does.
This is where I am now. My computer is disconnected from the internet, and I’m avoiding using the computer for anything but scans. I’m not sure how I would’ve gotten a Trojan, since I haven’t opened any e-mails recently, followed any suspicious links, or gone to any new websites. Whatever the cause, I would greatly appreciate some advice on how to proceed.
