Threat blocked after reboot

Eddy · 2017-08-20T20:22:40.000Z

https://forum.avast.com/index.php?topic=194892.0

polonus · 2017-08-20T20:53:21.000Z

Hi The Game2,

Just present the demanded log files and wait for a qualified remover to apear to assist you with eventual cleansing.

However there is a possibility of this being a FP (legacy of a once AVG detection).
Did the message appear after a restart of Windows 8.1?
Was there any association with files like Seamonkey.exe & Ammsetup(1).tmp?

Genuine infection with this malware always comes after a suspicious or malicious download from a malicious URL.
Signs of infection, slow computer, high on CPU and RAM and even system crashes.

So present the demanded logfiles and wait for one of our qualified malware removal experts.

polonus

TheGame2 · 2017-08-21T09:41:39.000Z

In fact, i am under Windows 10, i never played SeaMonkey, and this alert appeared with a completely different filename that Seamonkey . exe or Ammsetup(1) . tmp (my filename looked like an hexadecimal name) and avast didn’t show the extension.

I also need to know where i can find the log files.

Asyn · 2017-08-21T10:00:18.000Z

The Game2 post:4:

I also need to know where i can find the log files.

Follow the link in Reply #1 from Eddy.

TheGame2 · 2017-08-21T11:32:21.000Z

There are the log files (Transferred from PC )
Sorry if these logs are in French.

TheGame2 · 2017-08-21T18:32:09.000Z

For info, i just noticed that the popup and filename looked exactly the same than this :
https://forum.avast.com/index.php?action=dlattach;topic=202866.0;attach=192466;image

Image found in this thread :
https://forum.avast.com/index.php?topic=202866.0

TheGame2 · 2017-08-22T10:33:11.000Z

I have sent the log files, but no answer since yesterday morning.

Eddy · 2017-08-22T10:45:37.000Z

Learn to have patience.
The people here are all real people and do have their own lives.

TheGame2 · 2017-08-23T09:49:20.000Z

O.K. For me, it just seemed strange to have such a delay.

P.S : I clicked on “INDEPENDENT Support… etc.” and i was brought to hxxp://chat.ache.nl
Do you know what it is ?

SassDrake · 2017-08-23T14:33:32.000Z

Open Notepad (click Start button → type notepad.exe → press Enter)
Copy text from code block below and paste it into Notepad

Task: {BACBCAFE-601B-4DA8-95B1-00102DBBBC34} - System32\Tasks\App Explorer => C:\Users\Bastien\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [2016-09-17] (SweetLabs, Inc) <==== ATTENTION
C:\Users\Bastien\AppData\Local\Host App Service
EmptyTemp:

Go to File → Save As
Make sure that UTF-8 is selected as Encoding (left side of Save button)
Save it as fixlist.txt on Desktop
Open again FRST and click on button Fix
Wait until FRST finishes
fixlog.txt should be genereted and opened. Attach it your post and wait further instructions.

Please attach screenshot of Avast blocked popup.

TheGame2 · 2017-08-23T19:09:05.000Z

Here is the log.

P.S : Which “Threat Blocked” image ?.

SassDrake · 2017-08-23T19:54:16.000Z

If Avast message still show after reboot take screenshot of it.

TheGame2 · 2017-08-24T07:33:17.000Z

For the five days since the alert was given, i rebooted many times. There was no Avast alert, but i was sure something happened in the C/ drive.

Finally, i rebooted this morning after the fix, made a little text and 3d simulation, scanned the PC with Avast, and nothing happened.

SassDrake · 2017-08-24T07:40:24.000Z

• The following will implement some post-cleanup procedures:

=> Please download [https://toolslib.net/downloads/finish/2-delfix/[b][u]DelFix[/u][/b][/url] by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Eddy · 2017-08-24T07:45:59.000Z

P.S : I clicked on "INDEPENDENT Support.... etc." and i was brought to http://chat.ache.nl Do you know what it is ?

It clearly says what it is.

TheGame2 · 2017-08-24T15:49:38.000Z

I did it.
Now, what must i do with this file ?

TheGame2 · 2017-08-24T16:03:24.000Z

I did the procedure and i have the DelFix.txt file.

Now, what must i do with this file ?

Pondus · 2017-08-24T16:08:57.000Z

The Game2 post:18:

I did the procedure and i have the DelFix.txt file.

Now, what must i do with this file ?

Whatever you want. DelFix has removed the Tools used by Sass Drake …log should say so

TheGame2 · 2017-08-24T16:16:51.000Z

So, the PC is now clean ? ???

P.S. : Sorry to have posted twice the same message !

SassDrake · 2017-08-24T18:11:05.000Z

Yup. It is clean according to fresh FRST logs.

Announcements