Some sort of devilry...

Hello, I’m new to these forums, but I’ve been using avast (the free version) for my toshiba laptop (Windows 7) for over a year now and it’s worked pretty good, but as of late I’ve had several issues.

Firstly, every time I turn on my computer. I avast goes off and gives 30+ virus alerts, the red box will pop up and there’s all of this noise and whatnot. But unlike most alerts I’ve seen, this notifications won’t let me click on them, the only option I have is to “report as a false positive” the process that it shows is “C:\Windows\SysWOW64\lssasr.exe”. This may coincide with another issue I’ve been having lately, that of my windows firewall turning off. I turn it back on. Also it turns off my microsoft update thingy. And I have to manually turn them back on.

Usually when I get the notice that my firewall has been turned off I just click the notification to turn it back on, but when I try to go into the control panel to manually turn it back on, windows explorer often freezes up and stops responding.

Let’s see, what else? Oh yes, I’m not sure if it’s related but a few days ago my facebook account was hacked and my account spammed advertisements in all of the groups I was a part of. I changed my password but a few hours later it did it again. I reset my account and that seemed to kill that. But I’m still having these firewall issues as well as the daily dose of 30+ virus alerts.

I’ve run several AV scans, spybot, malwarebytes, and avast regular and boot time scans. All came up clean, I ran them in safe mode with networking and nothing still. Ironically it was during one of these scans in safemode when my facebook account was first hacked.

Whatever this thing is, it has me totally outmatched. I’ve done everything I know how to do. Help plz.

and what malware names does avast give these detections?
screenshot may help?

follow ths guide and attach the requested logs…not copy and paste http://forum.avast.com/index.php?topic=53253.0

AdwCleaner
Malwarebytes
OTL
aswMBR

when done the removal specialists will be notified and help you. it may take hours before one arrive so be patient

Monitoring… :slight_smile:

Avast classifies them as trojans. I’ll get a screen-shot next time it comes up.

And should I do all of those steps in the guide or simply the ones applicable to my situation?

hey you should follow the guide and attach all the logs in that link that was given to you by pondus. those log is needed for malware expert to be able to help you to the best.

Okay, I’m halfway through it, should have all the logs ready soon. In the meantime here is a screen shot of the trojan spam. Those 33 alerts stack up like that within a minute or so.

Okay I got all the logs, here they are.

sorry for triple post but it wouldn’t let my attach the remaining logs, here they are:

Thanks for getting us those…

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

[*]Disable any script blocking protection
[*]Right-click and Run as Administrator dds to run the tool.
[*]When done, two DDS.txt’s will open.
[*]Save both reports to your desktop.

Please attach the contents of the following in your next reply:

DDS.txt

Attach.txt

What is that and how do I disable it? It sounds vaguely familiar and has something to do with browsers I think. I use google Chrome.

if you dont know, i guess you dont have it :wink:

Righty then. here are the logs:

now wait for jeffce to come back…it may take hours

  1. No rush here, he can take all the time he needs. Nothing catastrophic has happened yet.

Hi,

ComboFix

Download Combofix from the link below, and save it to your desktop.
Link

Note: It is important that it is saved directly to your desktop
If you get a message saying “Illegal operation attempted on a registry key that has been marked for deletion”, please restart your computer.


IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here


Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.
When finished, it will produce a report for you.
[*]Please post the C:\ComboFix.txt for further review.


Here it is:

How is your system running?

Um, good for the most part i think. The only issue are that windows explorer will sometimes freeze up when I try to turn my firewall back on. Also I dunno is this is related, but I get an unusual amount of lag in the games I play, when others with identical comp specs and connections don’t get nearly as much.

Hi,

Let’s see if anything else is hiding in there…

http://i1224.photobucket.com/albums/ee380/jeffce74/java.jpg
I see that your Java software is out of date. Please go to Start >> Control Panel >> Programs and Features >> uninstall all versions of Java.

Now download and install the newest version from here >> http://java.com/en/download/index.jsp

http://i1224.photobucket.com/albums/ee380/jeffce74/java.jpg
Clear Java Cache

See this page for instructions on how to clear java’s cache.

Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
[*]Under Temporary Internet Files, click the Delete Files button.[*]There are three options in the window to clear the cache - Leave ALL 3 Checked
Downloaded Applets
Downloaded Applications
Other Files
[*]Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.[*]Click OK to leave the Java Control Panel.



http://i1224.photobucket.com/albums/ee380/jeffce74/mbam-3.jpg
Malwarebytes

Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

ESET Online Scanner

Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
[*]Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.[*] Turn off the real time scanner of any existing antivirus program while performing the online scan[*]Tick the box next to YES, I accept the Terms of Use.[*]Click Start[*]When asked, allow the activex control to install[*]Click Start[*]Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.[*]Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.[*]Click Scan[]Wait for the scan to finish[]When the scan is done, if it shows a screen that says “Threats found!”, then click “List of found threats”, and then click “Export to text file…”[] Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.[]Close the ESET online scan, and let me know how things are now.

Sorry, I’ve been busy with work for a few days. But the the mbam log is attached and requested, and this is what the ESET scan came up with:

C:\Users\Alexander\Desktop\System’\KeyGen.exe a variant of Win32/Keygen.CU application