URL: MAL False Positive or Infection? [SOLVED]

Viruses and worms
21

I need to know a file sharing service that is free as I do not use any at the moment.

22

Try this link https://dl.dropboxusercontent.com/u/73555776/avz4.zip

You can use dropbox as that is what I use to transfer files

23

Avz did not detect anything there is no log file to upload.

24

Could you upload the zip file as there is some analysis data in there that will show me what is running

25

There were two zips so I’ve uploaded both.

https://www.dropbox.com/s/ma118ovoemesgoq/virusinfo_syscure.zip?dl=0

https://www.dropbox.com/s/n6xeq3386r9sx1s/virusinfo_autoquarantine.zip?dl=0

26

FIX

Open AVZ as before
Click “File” > “Custom scripts”

https://dl.dropboxusercontent.com/u/73555776/avzfix1.png

A dialogue will open
Copy and paste the following script into the marked space then press run

https://dl.dropboxusercontent.com/u/73555776/avzfix2.JPG

Script for insertion :


begin
 DelCLSID('{8A69D345-D564-463c-AFF1-A69D9E530F96}');
 DeleteFile('.dll','32');
 DeleteFile('C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe','32');
ExecuteSysClean;
end.

Ensure that you copy from begin to end

27

Done what do I do now? Also what did you find?

28

The PC is no longer booting. It is stuck on a black screen.

29

I decided to research the IP at the start of the adress turns out it leads to our Internet Provider. This has two Blacklisted items. https://www.virustotal.com/en/ip-address/91.74.184.33/information/

30

Is the computer booting now ?

31

After I refreshed it and did a clean install. I found out why none of us could find a virus. There wasn’t one. ! Avast was tagging the Dubai download servers depending on the content which is why aswMBR and AVtool were the only ones being targeted.

32

Avast! flagging All Dl servers from Dubai? I find that hard to believe…

Why did you clean install your system? Essexboy could’ve repaired it (In all likelyhood)/

33

It didn’t flag all. But I know these are false positives and thus this case is closed. The information I lost wasn’t too much so at least I can fix this. I can prove that these are False Positives by simply looking at the adress used on other downloads which tie into other servers here in Dubai. Meaning avast started flagging servers based on the content they were bouncing to me, I’m assuming that Avasts newest definitions caused this as the problem arose at definition update on the 5th or before it when Avast blocked itself from updating, in the code it has an adress linking to a server here probably used for downloads.