Threat: Win32:Trojan-gen in Windows\Installer .msi file

Viruses and worms
1

Hello, I have a problem dealing with issue spotted by Avast!'s scan.
On a full scan it has picked up file C:\Windows\Installer\537ef9a.msi in which it has found the Win32:Trojan-gen and couldn’t access rest of files within that .msi file.
No action can be taken against the Trojan :
Repair = Error 42060
Move to Chest = Error 42111
Delete = Error 42111

I’ve only picked up on this recently, I didn’t have computer behave strangely and I’ve been downloading plenty of files, thus I can’t say for certain when or where did it come from.
As for now, only Avast! picks up on this file, Malwarebytes Anti-Malware sees nothing.

I’ve tried starting up pc in Safe Mode, scanning again with Avast! and resolving the issue there, but effects were same as in Normal mode.

Online Scanner :
Metascan Online : https://www.metascan-online.com/en/scanresult/file/4639848a162f4908aaac6c72d7291fb4
1 Threat detected : Symantec - Encrypted Container Deleted

I’ve attatched the Avast! report (just from localised scan, only Windows\Installer folder).
I’ve also added the HijackThis log.

Thanks ahead for any assistance!

EDIT :
I’ve forgotten to mention I am using Windows 7 Home Premium version.
If there’s any other information needed I’ll provide it as soon as I can.

2

Hi Toka,

Download DDS and save it to your Desktop from here:
http://download.bleepingcomputer.com/sUBs/dds.scr

Double click dds to run the tool.

* When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt

Save both reports to your desktop. DDS.txt and Attach.txt attach back to topic.

3

Done, both are availiable in the main post attatchments.

4

Please download zoek.zip (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

{D4027C7F-154A-4066-A1AD-4243D8127440};c
C:\Program Files (x86)\Ask.com;fs
{32099AAC-C132-4136-9E9A-4E364A424E17};c
C:\Program Files (x86)\DAEMON Tools Toolbar;fs
{555D4D79-4BD2-4094-A395-CFC534424A05};c
C:\Program Files (x86)\Skype\Toolbars;fs
{91774881-D725-4E58-B298-07617B9B86A8};c
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D};c
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324};c
filesrcm;
startupall;
skipfix-iedefaults;
firefoxlook;
chromelook;
autoclean;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

---------Next--------

  1. Please download ComboFix from here and save it to your Desktop.
    If you are unsure how ComboFix works please read this guide carefully.
    note: ComboFix must be downloaded to your Desktop.
  1. Temporarily disable your AntiVirus program.
    If you are unsure how to do this please read this or this Instruction.

Instructions how to disable avast:

[*]Right-click on the avast! icon in the lower right corner of the screen and choose Open Avast! User Interface.
[*]In the window that opens on the top right corner, click Settings.
[*]In a new window that opens, choose the option Troubleshooting, Uncheck Enable avast! self-defense, and click OK.
[*]=> Again, right-click on the avast! icon in the lower right corner of the screen and select avast! shield controls .
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.

Note: Do not forget to turn on this option after the cleaning.

  1. Run ComboFix. Click on I Agree!

ComboFix will check if there is a newer version of ComboFix available.
Click Yes if prompted to download.
ComboFix will display DISCLAIMER OF WARRANTY ON SOFTWARE.
Click Yes to allow ComboFix to continue.
If Recovery Console is not installed, ComboFix will offer download & installation.
Click Yes to allow ComboFix to install Recovery Console.
Note:Do not mouse-click Combofix’s window while it is running.
If you see a message like “Illegal operation attempted on a registry key that has been marked for deletion” just restart computer once more.

  1. When the tool is finished, it will produce a log report for you. (typical location: C:[b]ComboFix.txt[/b] )
    Attach log reports ( ComboFix.txt) back to topic.
5

Zoek and ComboFix logs are added to this post.
Just a quick question for future though : Should I usually add logs to the main post or to the replies ?

6

System is clean. Possible FP detection.

It is necessary to uninstall ComboFix :

[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.

On Windows7 or Vista you may use Start Search field if Run is not available.

[*] In the line of text type in (Copy) the following:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

[*] then click OK (or press Enter ).

Wait for the uninstall process is complete.

7

Thank You!

Much appreciated.

I assume I don’t have to worry about that “FP” thing ?

8
I assume I don't have to worry about that "FP" thing ?

No.