I got an Avast dialog that indicated there was a “suspicious file found” on my system. I told it to delete it, reboot and run a complete scan. When the scan started I selected Delete All and let it run overnight. I seemed to find a number of infected file, which I assumed would get deleted, but when the system rebooted I got the same error message. So I did the same thing again, this time selected Chest All for the scan. Again it found infected file, and again when the system came back up I still had the message for PHYSICALDRIVE0 MBR:Whistler. This time I chose not to reboot, but to just delete it.
I am a little confused as I have Real-Time scan running and my version is 110621-1, so it is up to date. Where did these infections come from, and how do I get rid of them ? I submitted the original file that the problem was found with, which was an Avast .dat file as potential malware. What other data is needed ?
Where did these infections come from, and how do I get rid of them ?You had what we call an MBR infection. It lives outside of the Windows operating system but delivers it's payload into Windows. Since it's not within Windows itself, your resident security program may have difficulties dealing with it. by:sUBs
more info:
http://www.securelist.com/en/analysis/204792157/TDSS_TDL_4
…
Download AVP tool from here:
http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
Run the program you have just downloaded to your desktop (it will be randomly named )
First we will run a virus scan.
[*] On the first tab select all elements down to Computer and then select start scan.
[*] Use the recommended option that programs offer you.
[*] Once it has finished select report and post that.
Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop.
Now an analysis scan
[*] Select the Manual Disinfection tab
[*] Press the Gather System Information button
[*] Once done Open the last report saved folder then attach the zip file to your next post.
The file is located at your Desktop\ Virus Removal Tool\ setup_9.0.0.722_05.01.2011_20-34 [b]LOG[/b] \ avptool_sysinfo.zip
Please attach that too.
==============
Download aswMBR to your desktop.
[*] Double click the aswMBR icon to run it.
[*] Vista and Windows 7 users right click the icon and choose “Run as administrator”.
[*] Click the Scan button to start scan.
[*] When it finishes, press the Save log button, save the logfile to your desktop and post its contents in your next reply.