Strange txt file in C:\

HI. After upgrading my avastHOME 4.7 to 4.8 in C:\ i found a strange txt file named “1.txt”. Inside i can find smomething like this:
URL: http://forum.avast.com/index.php?board=2.0

Action: http://forum.avast.com/index.php?action=search2
Method: post
search(text):

Action: http://forum.avast.com/index.php
Method: get
jumpto(select): ?board=2.0 [checked]

It changes acording to the site, this is what it shows now. It doesnt change if i use Mozila Firefox, olny with IE. I checked my system no viruses, no new unknown processes running. Also i am using IE 6.0 and my avast is version 4.8.1201. Anny suggestions? Thanks in advance

Hill, the links you’ve posted are from avast forums, are they included into the 1.txt file?
If you delete the file, will it reappear?

General cleaning procedure includes:

  1. Disable System Restore and reenable it after step 3.
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast with archive scanning turned on.
  4. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.

If what you’re experiencing is only in IE and not Firefox, one other possibility is cookies - don’t forget that IE cookies are individual TXTs, as opposed to entries in one of the Firefox profile files.

C:\ is an odd location for these (usually they’re in one or more Temporary Internet Files folders), which is why Tech’s suggestions are a better starting point. But if I remember correctly, you can change the default location for IE cookies, cache, etc.

After scanning with Spyware Terminator i found out it was somekind of spyware, i removed it with the program but after 2 restarts of my system the file showed up again. So i reinstalled windows and now its gone :). Thanks for the suggestions.

Glad you’ve succeed. I’d like to suggest you a full computer on-line scanning:
Kaspersky (very good detection rates)
ESET NOD32
Trendmicro housecall
F-Secure
BitDefender (free removal of the malware)

Thanks, i will try them but i think its gone because before reinstalling windows i formated the whole C:\ :slight_smile:

Ok… after formating and a Windows installation from scratch… generally, infection will be gone of course :wink: