system
October 20, 2010, 1:16pm
1
Avast is detecting this win32:Bamital-AE in winlogon. When I tell it to “Move to Chest” which is the recommended action, it can’t. It says the file is Read-only. My problems started a few weeks ago with what I think was some sort of Google Hijack virus. I downloaded MalwareBytes program and it seemed to help, but I’m still having this problem with this virus.
I downloaded hijackthis…and this was my log:
Logfile of Trend Micro HijackThis v2.0.4
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://eeepc.asus.com/global http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157
cont. next post…
system
October 20, 2010, 1:18pm
2
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1255759670375 http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1255759660296 https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
system
October 20, 2010, 1:19pm
3
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllwww.systweak.com ) - D:\Program Files\Advanced System Optimizer 3\ASO3DefragSrv.exe
–
Please help
the only thing i can say is to do a scan with malware-bytes,in safe mode
www.malwarebytes.org
system
October 20, 2010, 1:40pm
5
http://forum.avast.com/index.php?topic=53253.0 carefully read first post(skip mbam part, might not be much help here since you have system file infected). attach OTL.txt and extras.txt in this topic. if these logs are too big to attach, upload them to mediafire.com or other filehosting and post download link here.
system
October 20, 2010, 5:08pm
6
I updated Malwarebates and ran it in safe mode. It didn’t find anything.www.malwarebytes.org
Database version: 4891
Windows 5.1.2600 Service Pack 3 (Safe Mode)
10/20/2010 11:13:56 AM
Scan type: Full scan (C:|D:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
system
October 20, 2010, 6:00pm
7
What filename is Avast detecting?
You can try Hitman Pro - Second Opinion Malware Scanner .
system
October 20, 2010, 6:09pm
8
system
October 20, 2010, 6:11pm
9
Avast says it’s a win32:Bamital-AE in winlogon.exe
It comes up a ton…whenever I try to navigate basically. I seem to have some sort of google hijack thing going on which I thought Malwarebyte had taken care of. Not sure if they’re related.
Left123
October 20, 2010, 7:01pm
10
if you can’t wait for essexboy,try with kaspersky a very powerful avhttp://www.kaspersky.com/
There is at the moment only one programme that I have been able to use sucessfully on this beastie. Whilst I download and check the main OTL log
Download Dr Web from here http://www.freedrweb.com/?lng=en link on the top right of the page, tick the EULA and then download
It will download as an 8 digit file save it to your desktop
Restart in safe mode and run
system
October 20, 2010, 7:30pm
12
Thanks. I’ll download Dr. Web and post the results in a few.
I did Hitman and it found it… as well as a Trojan in IE. It wanted to delete the winlogon file which I’m assuming is not a good idea. Should I quarantine it or just leave it alone for now?
Do not
system
October 21, 2010, 2:13am
14
I did that and it didn’t find anything. I can’t seem to find the program or its log, though. There’s no icon…and it’s not in my program files. Is DrWeb just a web-based thing? Do I need to purchase a full version or something? I can go and re-download it… but once again, it doesn’t give me any sort of icon to “re-find” it.
Sorry, I’m not that computer literate. My husband was trying to help me and the Think Point virus came up. I think I got rid of it via Malwarebye in SafeMode…at least I hope so.
system
October 21, 2010, 8:48am
15
Pondus
October 21, 2010, 9:53am
16
when you download Dr.Web save it to the desktop and run from there. you should see a green icon
mkis
October 21, 2010, 9:55am
17
Umsami you are running too much antivirus at the same time - Symantec, avast, to say the least.
There will be problems as different brands of antivirus are likely to compete when running at the same time - as has been explained as two dogs fighting over the one bone, there will be problems.
You need - in the least - to decide between running avast or Symantec.
system
October 21, 2010, 1:47pm
18
Thanks. I had only Avast on, but my husband has added all of the ones he likes in hopes of fixing it. He doesn’t believe in Avast; whereas I’m quite happy with it.
I think I’m just going to reformat everything. It’s easier.
mkis
October 21, 2010, 5:23pm
19
I was reading you opening post, but now I’ve looked at some of the logs and I know what you mean.
You could try to upload the file c:\windows\system32\winlogon.exe to Virustotal and see what results
http://www.virustotal.com/
click Choose File, browse to the winlogon.exe file on your computer, upload to Virustotal and click Send File
Winlogon and Explorer have data attached to them by the malware - if you run the version of Dr Web that I posted from safe mode that should cure it. On completion we will then check for any remaining malware and look at giving your system a little TLC ;D
