Trojan found in Boot scan, did it get past Avast?

Viruses and worms
1

I ran a boot scan that found 5 infected files, one was a trojan win32. I moved it to the chest, but I can’t figure out if it was hurting my pc yet or not. How did it get into my pc with Avast protection in place? Did Avast block it? If so, how did it show up on the Boot scan?

2
How did it get into my pc with Avast protection in place?
no security program have 100% detection

the rest is not possible to answer…as you give no info
what malware name(s) did avast give the file(s)… same on all 5 ?
what file(s) was detected ?
where was they located…full path ?

3

what malware name(s) did avast give the file(s)… same on all 5 ?
what file(s) was detected ?
where was they located…full path ?

Here are the 5 infected files that Avast Boot scan found:
1= C:\hp\bin\killit.exe
2= C:\hp\bin\ProcessLogger.exe
3= C:\SystemVolumeInformation_restore(B06C75FO-9FCC-4D32-A4A4-58CDE7C44A50)\RP84\A0029190.exe
4= C:\SystemVolumeInformation_restore(B06C75FO-9FCC-4D32-A4A4-58CDE7C44A50)\RP84\A0029191.exe
5= D:\PRELOAD\BASE_05.IND

Here is the Status for them:
1= PUP:Win32:KillApp-W [PUP]
2= PUP:Win32:PUP-gen [PUP]
3= PUP:Win32:KillApp-W [PUP]
4= PUP:Win32:PUP-gen [PUP]
5= Threat:Win32:QHost-CCK [Trj]

This is all the info that I can get from the Chest. I hope it gives you enough to answer all your questions, and thank you so much for your help!

4

PUP is not a virus - Possible Unwanted Program
avast is just telling you that that it have detected a program that can be used for good or bad if abused
and the c\hp\bin… files belongs to a hp factory installed program…
this PUP detection have been reported many times before…you see if you search the forum…
those in system volum information are just restore point copys of the same…

the last one [trj]…may be a real detection…

run a quick scan with malwarebytes for a extra check and post the scan log here
http://forum.avast.com/index.php?topic=53253.0

5

The preload appears to be part of the system recovery partition… Is the recovery partition on D drive ?

6

Thank you Pondus:

Here is the result of Malware QuickScan:

Malwarebytes’ Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/5/2012 2:03:45 PM
2012-08-05 (14-02-49).txt

Scan type: Quick Scan
Objects scanned: 108747
Time elapsed: 10 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) → No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Malware removed the infected objects successfully.

Thank you again for all your help!

7

check back later in case Essexboy have anything to add…

8

Nope I am happy