So i just downloaded avast, and to date i am very pleased with this program. However, after a full system scan and re-boot scan I was notified that I have the following virus “Win32.DNSChanger VJ.Trj.”
I noticed many threads dealing with this topic and instead of follow directions meant for others i figured i would reach out for my own situation. The file that is constantly under attack is C:\Windows\assembly\tmp\u\80000032.@. Also like any others, I can not turn on my windows firewall and I was getting the website re-direct as well on google searches. I recently downloaded the Malwarebytes Anti-Malware software. However, I do not have the log on me because I am contacting you from my work computer.
Any assistance would be greatly appreciated? I have a Windows 7 software on the computer. I have been dealing with this virus for about two weeks and I have had enough and would like to get some normalcy back to my computer.
This needs further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware. Use the information about getting and using the logs and attach the logs here, not in the LOGS topic.
Here are the logs. I haven’t received any other alerts from avast yet. The windows firewall is still down and it won’t allow me to turn it on. Before I sent the initial post, I let avast do the scan during the re-boot and alot of files were deleted or sent to chest. If memory recalls the assembly files was one of them as well as some java files.
Essexboy should be back on-line around 7pm UK time (now just after 3:30pm) and will take a look at the logs.
Whilst the aswMBR shows “20:42:29.462 Disk 0 unknown MBR code” this could be either OK or bad as some malware will change the MBR code and in other cases if you have say a Dell or HP, etc. they could be setup with a custom MBR code. This would allow you to access their recovery console and or recovery partition.
Do you have a Dell, HP or other manufactures system where this might be the case (if so what is the manufacturer) ?
The OTL logs will need to be analysed by someone familiar with the output.
I have an HP laptop. I have tried the ystem recoery before and it won’t let me. Ever since I did the avast scan on re-boot, and alot of the files were deleted I haven’t gotten the pop up notification. Also note many of the files came up as error when avast attempted to repair them so deletion was the only solution.
In regards to the windows firewall, i kept getting an error 1068 notification. When I try turning it on, it pops up and tells me to turn on manually; however, i cant do that either.
That could be the cause of the unknown MBR, e.g. it is a custom MBR. So you have to take care with this custom MBR or you could end up blocking access to your recovery console.
If you use tools that can change the MBR back to a default one you would lose that access or if malware changed it, that too could block the access to the HP recovery console. So this one will have to be approached with care by a malware removal specialist.
However, I do notice lots of references in the extras.txt to AVG 2011 and 2012 and “NIS” = Norton Internet Security, do you still have these installed ?
I see lots of references to AVG and Symantec running services in the otl.txt
Having two resident anti-virus scanners installed is one too many and not recommended as rather than provide twice the protection it can cause conflicts that could leave you more vulnerable.
If you have NIS installed that has a firewall and would disable the windows one.
Having two resident anti-virus scanners installed is one too many and not recommended as rather than provide twice the protection it can cause conflicts that could leave you more vulnerable.
and in this case it seem to be tree.....may be new forum record ;D
The norton anti-virus came with the laptop but it isn’t on, also I had AVG on the laptop but I un-installed it thru Control Panel, since I was not very pleased with it. The only one active is avast. I definitely think it was the malware that blocked it, since the computer would then automatically restart after failure in the recovery mode.
In regards to the firewalls, they all say off. When I try turning the windows one on, i get the error 1068 and i also get this error "Could not load file or assembly ‘sorttbls.nlp’ or one of its dependencies. The system cantnot find the file specified.
I know the Trojan virus was attached to that assembly file.
The norton anti-virus came with the laptop but it isn't on, also I had AVG on the laptop but I un-installed it thru Control Panel, since I was not very pleased with it.
you cant just turn off....you need to remove...using the removal tool in my post above, run and reboot......AVG tool and Symantec/Norton tool
You need to uninstall it and Norton can be a bit of a pig to remove so you may need its removal tool also.
A link worth looking at, which is a program removal tool that can remove the remnants of a number of different Norton Programs: Removing your Norton program using SymNRT
There is also an AVG removal tool:
Ensure that all remnants of AVG are gone - AVG8.x (or higher) Remover, download tool from here, http://www.avg.com/us-en/utilities there is a 32bit and 64 bit windows version, ensure you use the correct one.
Download ComboFix from one of the following locations: Link 1 Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
I am trying to post my combofix log but I am getting this message…c:Program Files(x86)\Internet Explorer\iexplore.exe Illegal operation attempted on a registry key that has been marked for deletion.
Internet explorer is the only browser I have on my comp. What do i do now if I can’t get online?