Win32:Dropper-gen (Drp) and Win 32:Adware-gen (Adw)

Viruses and worms
1

Need some help please. Not pc-savvy, new to avast and first time in a forum.
Getting numerous alerts from avast regarding the above. Ran scan, moved threats to chest but every five minutes or so getting more and more alerts. Restarted in safe mode, ran boot-time scan, more stuff moved to the chest but the alerts are still coming through. I dont know how to post scan log links but heres what the boot-time scan found:-

C:\Program Data\AVAST Software\Avast\report\aswBoot.txt
File C:\Users\Audrey\AppData\Local\Temp\1bd92d4b\temp\ext IE_setup.exe is infected by Win 32:InstalleRex-Z [PUP]
File C:\Users\Audrey\AppData\Local\Temp\1bd92d4b\temp\setupb.exe is infected by Win 32:InstalleRex-Z [PUP
File C:\Users\Audrey\AppData\Local\Temp\1bd92d4b\temp\setupespl.exe is infected by Win 32:InstalleRex-Z [PUP]
File C:\Users\Audrey\AppData\Local\Temp\1bd92d4b\temp\setupytb.exe is infected by Win 32:InstalleRex-Z [PUP]
all moved to chest

File C:\Windows\Service Profiles\Network Service\AppData\Local\Temp\mpam-a49de47a.exe|>mpavbase.vdm Error 42127 {CAB archive is corrupted}

Any help much appreciated, thanks

2

Attach your basic logs. (MBAM, FRST and aswMBR…!!)
Instructions: https://forum.avast.com/index.php?topic=53253.0

3
I dont know how to post scan log links ........................
below the box you write in you will see ....... [b]Attachments and other options[/b]
4

Thanks for your help, here are the logs

aswMBR did not run fully, error message came up and it restarted the laptop
IRQL_NOT_LESS_OR_EQUAL

5

You’re welcome. Now you’ve to wait a bit…

6

Let me know if all is well after this

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

SearchScopes: HKCU - DefaultScope {706C3937-4161-4756-B6D5-B970A3FD84EE} URL = SearchScopes: HKCU - {706C3937-4161-4756-B6D5-B970A3FD84EE} URL = C:\ProgramData\MakeMarkerFile.exe C:\Users\EasySurvey C:\Windows\Service Profiles\Network Service\AppData\Local\Temp\mpam-a49de47a.exe CMD: bitsadmin /reset /allusers CMD: DEL %TEMP%\*.* /F /S /Q CMD: RD /S /Q %TEMP% REBOOT:

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

7

Here is the fixlog file. I havent had any avast alert messages since I came home an hour ago. Can I now run avast and check? Thank you all so much for your help, and for walking me through what you needed, it’s very much appreciated.

8

Yes please run a scan… All I have done is emptied the temporary files where the bad boy was residing

Let me know how the scan goes

9

Ran a quick scan - No Threat Found, yipee!
Can I ask one last question please, what do I do with the 120+ entries in the chest from this? :-[

10

You can delete them from there

You can also set IE to delete all temporary files when you close it, if you would like instructions for that let me know

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

11

Ah, you’re a gem. I dont use IE (I dont like it), I use Chrome…and I use crap cleaner, but if you have better recommendations then please do as I know very little about these things. Will drop you a line tomorrow evening to let you know if all still good. Have a good night, and thanks again