Repeating Avast Web Shield blocked a harmful webpage or file

Eddy · 2015-04-25T15:29:10.000Z

For EssexBoy, this is what I came up with for the fixlist:

Start CreateRestorePoint: Closeprocesses: Emptytemp: HKLM\...\Run: [] => [X] HKLM\...\Policies\Explorer: [NoCDBurning] 0 HKU\S-1-5-21-1044272327-3890023630-4042175641-1009\...\Run: [CDDB Update] => regsvr32.exe "C:\Documents and Settings\L-3\Local Settings\Application Data\CDDB\EP0NH4J3.DLL" ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled. CHR StartupUrls: Default -> "hxxp://www.google.com/" S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] 2015-04-25 03:00 - 2015-04-25 03:00 - 00000000 ____D () C:\257a568577d13e68e74fd4c26064 URLSearchHook: HKU\S-1-5-21-1044272327-3890023630-4042175641-1009 - (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File BHO: Google Dictionary Compression sdch -> {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} -> C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll No File Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll No File DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_15-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_15-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f CMD: ipconfig /flushdns CMD: ipconfig /release CMD: ipconfig /renew CMD: netsh winsock reset catalog CMD: bitsadmin /reset /allusers End

system · 2015-04-25T16:02:18.000Z

So I ran FRST with the new fixlist but the alerts have not stopped. Attached is the latest fixlog file.

essexboy · 2015-04-25T16:35:14.000Z

Somehow I did not feel it would

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · 2015-04-25T17:30:55.000Z

ComboFix got past step 50 then started deleteting some files and then I got a blue screen. The think the message stated that mbr.sys driver was halted with items in que. I used BlueScreenView to View the following message.

“Mini042515-03.dmp 4/25/2015 10:11:37 AM SYSTEM_SCAN_AT_RAISED_IRQL_CAUGHT_IMPROPER_DRIVER_UNLOAD 0x100000d4 0xb2add61e 0x00000002 0x00000001 0x806e7a16 hal.dll hal.dll+2a16 Hardware Abstraction Layer DLL Microsoft® Windows® Operating System Microsoft Corporation 5.1.2600.5512 (xpsp.080413-2111) 32-bit hal.dll+2a16 ntoskrnl.exe+154f93 ntoskrnl.exe+fae95 ntoskrnl.exe+fb232 C:\WINDOWS\Minidump\Mini042515-03.dmp 4 15 2600 90,112 4/25/2015 10:13:42 AM”

essexboy · 2015-04-25T18:46:25.000Z

Did the sytem reboot OK ?

Is there a log at c:\combofix.txt

system · 2015-04-26T13:28:05.000Z

Yes the system rebooted OK but blue screened again later. I have attached the Combofix.txt file.

essexboy · 2015-04-26T13:46:07.000Z

Does the blue screen reference a driver ?

Are the alerts still present

system · 2015-04-26T14:16:25.000Z

Yes the alarts are still occuring. I attached the blue screen crash list. I’m not very familar with the BlueScreen program so let me know if I provided the wronge info.

system · 2015-04-26T14:31:33.000Z

Here is the BlueScreen dump file.

system · 2015-04-26T15:01:52.000Z

Just to be clear, the Blue screen data I have sent you pertains to only the most recent crash. There are 41 crashes listed.

essexboy · 2015-04-26T15:52:18.000Z

Could you re-run combofix please, allow it to update if it asks

system · 2015-04-26T17:38:06.000Z

Here you go. No change in the problem.

essexboy · 2015-04-26T18:39:34.000Z

Could you download a fresh copy of FRST please, run the scan again but this time also tick shortcut txt
Please download Farbar Recovery Scan Tool and save it to your Desktop.

Then attach all 3 logs

system · 2015-04-27T04:40:41.000Z

Here are the FRST & Shortcut text files you requested.

system · 2015-04-27T05:43:25.000Z

I’m a little confused as to what file you wanted. Here are two files from FRST in my documents directory and one from the Desk Top directory. Is this what you requested?

essexboy · 2015-04-27T14:02:37.000Z

I am unable to locate the trigger yet

This programme will produce a zip file, could you upload that to a file sharing site for me to collect

Download AVZ tool from here to your desktop
Unzip all files to a folder on your desktop
Open the folder and double click the AVZ icon
https://dl.dropboxusercontent.com/u/73555776/avz.JPG

When the tool opens select “File” > “Standards scripts”

https://dl.dropboxusercontent.com/u/73555776/avz1.jpg

Place a tick in :

5. Update signature database

Then press “Execute selected scripts”

https://dl.dropboxusercontent.com/u/73555776/avz2.JPG

Once that has execute then
select “File” > “Standards scripts”
Place a tick in :

3. Advanced System Analysis with malware removal mode enabled

When finished look in the folder AVZ4 on your desktop
Open the LOG folder
Upload virusinfo_syscure to a file sharing site for me to collect

https://dl.dropboxusercontent.com/u/73555776/vz3.JPG

system · 2015-04-27T15:40:01.000Z

I preformed the scans and am ready to provide the log files. However, I am not familar with file sharing sites and don’t understand where you want me to upload them to. Also, do you want the zip, xml & htm versions of the virusinfo_secure files?

system · 2015-04-27T16:22:57.000Z

I think I figured out file sharing. Let me know if this works for you.

https://drive.google.com/file/d/0BwuFuigoTpS2Vk80WE50M2c5SWM/view?usp=sharing

system · 2015-04-27T16:36:24.000Z

Or perhaps this works?

https://drive.google.com/file/d/0BwuFuigoTpS2Ym5KeURoS1VtRmM/view?usp=sharing
https://drive.google.com/file/d/0BwuFuigoTpS2TlZHVTBFUmZoakE/view?usp=sharing

essexboy · 2015-04-27T16:51:05.000Z

Could you let me know if this makes a difference

FIX

Open AVZ as before
Click “File” > “Custom scripts”

https://dl.dropboxusercontent.com/u/73555776/avzfix1.png

A dialogue will open
Copy and paste the following script into the marked space then press run

https://dl.dropboxusercontent.com/u/73555776/avzfix2.JPG

Script for insertion :


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelCLSID('{FFB699E0-306A-11d3-8BD1-00104B6F7516}');
 DeleteFile('c:\051e59436ad68e9a9db4e57bce61\wgasetup.exe','32');
ExecuteSysClean;
RebootWindows(true);
end.

Ensure that you copy from begin to end

Announcements