Win32:Malware-gen popping up

Viruses and worms
1

Logged on to my computer this morning and was greeted with
"MALWARE BLOCKED

avast! File System Shield has blocked a threat.
No further action is required.

Object: C:\Users\David\AppData\Local\Temp\mwgmliry.dll
Infection: Win32:Malware-gen
Action: Moved to chest
Process: C:\Windows\Microsoft.NET\Framework\v2.0…\csc.exe

The threat was detected and blocked when the file was created or modified"

I moved the file out of the chest to upload it to jotti’s site url=http://virusscan.jotti.org/en-gb/scanresult/f1a5332c4f076e11a82be233b2548c2986729736[/url]. When I deleted it I got another message identical to the first except for
“Object: C:$RECYCLE.BIN\S-1-5-21-29068602…$RD09X97.dll
…
Process: C:\Windows\explorer.exe”

I’m currently running a full scan.

2

check your computer for malware with this

Malwarebytes Anti-Malware 1.50.1 http://filehippo.com/download_malwarebytes_anti_malware/
always update the program so you have lates database before you scan
click the remove selected button to quarantine any infections found
you may post the scan log here

3
Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org

Database version: 5550

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

18/01/2011 5:06:25 PM
mbam-log-2011-01-18 (17-06-25).txt

Scan type: Full scan (C:|)
Objects scanned: 631492
Time elapsed: 1 hour(s), 37 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

While it was scanning, I got another Avast message identical to the first one, but with the file “5xkgstgk.dll”

edit: If it’s any help, here are the OTL logs attached

4

Same thing here.

http://i.imgur.com/RtWvs.png

Started happening about 2 days ago. My husband is having the same issue apparently, in England. It pops up on every boot-up with some random .dll file, then randomly throughout the day.

5

I have begun experiencing the same thing. A friend in Norway is experiencing the same. My own case is both a desktop and laptop. Don’t think there’s any information I can add that provides any more insight.

6

I’m experiencing the same issue, starting this afternoon.

From my File System Shield log:

1/18/2011 2:00:41 PM C:\Users\Jeff\AppData\Local\Temp\wrzm9yjt.dll [L] Win32:Malware-gen (0)
File was successfully moved to chest…
1/18/2011 5:00:28 PM C:\Users\Jeff\AppData\Local\Temp\4fktxflg.dll [L] Win32:Malware-gen (0)
File was successfully moved to chest…
1/18/2011 8:00:28 PM C:\Users\Jeff\AppData\Local\Temp\q-ohkne9.dll [L] Win32:Malware-gen (0)
File was successfully moved to chest…
1/18/2011 11:00:56 PM C:\Users\Jeff\AppData\Local\Temp\llawn-lk.dll [L] Win32:Malware-gen (0)
File was successfully moved to chest…

It could just be a coincidence, I’m not sure, but the detected .dll is appearing about every 3 hours it seems.

7

This exact thing started happening to me this afternoon. Not once in a year has anything been detected until today. Last night I updated to the latest version of Avast (was told to update and restart computer). There have been four events today, all from C:\Users.…\AppData\Local\Temp folder. They have each been labeled a different .dll with the virus listed as Win32:Malware-gen.

I’ve run a full scan with Avast and it found nothing. I ran a full scan with Malwarebytes and it found nothing. And, I ran a scan with SuperAntiSpyware and it found only tracking cookies.

This is very strange! :o

8

Hello all.

I updated Avast when it prompted me to when I booted up my PC for the day. I am now having the exact same problem as the others. I ran a full scan on my PC with Avast and Malwarebytes and I keep getting this same error. Always the Win32:Malware-gen in the AppData folder. It happens pretty much as soon as my CPU is booted up and then periodically throughout the hours. Here are my malwarebytes results if it helps.

Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org

Database version: 4084

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

1/19/2011 1:44:02 AM
mbam-log-2011-01-19 (01-44-02).txt

Scan type: Full scan (C:|)
Objects scanned: 596444
Time elapsed: 1 hour(s), 43 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

9

@TheLoneTerran
You are using a old version of malwarebytes, it looks as you have never updated it since install

Malwarebytes' Anti-Malware 1.46 Database version: 4084
Latest is 1.50.1 with database 5552 when i post malwarebytes is releasing 5 - 10 updates a day
10

Very interesting, as there seems to be a 3 hour gap between a number of my alerts as well…

11

They all seem to be in temp folder…not sure if this will help but you can try

TFC - Temp File Cleaner by OldTimer
TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.
http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/

12

Thank you Pondus. I updated and am running another scan. I’ll post results when I get them. Ty.

13

The good thing with MBAM 1.50.1 it will promt you for update if you try scanning with and old database…
I think the default setting is 7 days…

14

Tried this, still getting the alerts

15

Have sendt a note to Essexboy so he will pop in when he arrives later (late) today…

he is usually in here from 8:00pm 11:59pm uk time

16

Hey all! New to the forums, havn’t ever needed assistance until now. I too am getting these alerts (Minneapolis MN). Quite a relief that im not the only one with this problem.
Ran a full scan with MBAM with no results except a tracking cookie (arg)

Unrelated question: Is Essexboy the resident malware guru?

17
Unrelated question: Is Essexboy the resident malware guru?
He is a trained and certified malware remover, and does most of his malware cleaning over at geeks to go

http://forum.avast.com/index.php?topic=53253.0

18

Coolness ;D

19

Pretty much same situation here (in Finland) - Avast reports at every computer wake up or start up Win32:Malware-gen, it is always some oddly named .dll file in temp. Process is always C:\Windows\Microsoft.NET\Framework\v2.0…\csc.exe. It also pops up during the usage every now and then - maybe every 3 hours, have to check. The problem started to present itself less than 24 hours ago I think, cannot figure out what has happened at that period.

Full scan reveals nothing, at least yesterday. same with latest MBAM yesterday, haven’t tried today. Same with Spybot but Ad-aware found suddenly 3 files associated with Dropper, and quarantined them. They were deleted - at the startup the same Avast warning still.

Went to sleep: today, the same warning. Currently doing startup scan with Avast, with maximum sensitivity. Next running Adaware, Spybot and MBAM fullscans again and then if none of it helps I will also use OTL and post log here. Unless of course during my time-taking scans the answer appears here magically :smiley:

EDIT: Nothing in MBAM fullscan, and nothing in Adaware fullscan so far. And by the look of it the yesterday’s Adaware scan may also been false alarm on Dropper, as it seems to mistake one game controller’s downloaded firmware update as Dropper (the update has been untouched for at least a year, and used controller all the time - no reason for it to activate now- just that I downloaded Adaware so it saw it now):

Description: c:\users\xxx\downloads\n52te_win_firmware_v1.04_eng(2).exe Family Name: Win32.TrojanDropper.Agent Engine: 1 Clean status: Success Item ID: 0 Family ID: 1037 MD5: 736be7da6f623a4676c252273392ba18
Description: c:\users\xxx\downloads\n52te_win_firmware_v1.04_eng(3).exe Family Name: Win32.TrojanDropper.Agent Engine: 1 Clean status: Success Item ID: 0 Family ID: 1037 MD5: 736be7da6f623a4676c252273392ba18
Description: c:\users\xxx\downloads\n52te_win_firmware_v1.04_eng.exe Family Name: Win32.TrojanDropper.Agent Engine: 1 Clean status: Success Item ID: 0 Family ID: 1037 MD5: 736be7da6f623a4676c252273392ba18

20

Hello. Posting my results from most recent, updated scan.

Malwarebytes’ Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5552

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18999

1/19/2011 3:54:55 AM
mbam-log-2011-01-19 (03-54-55).txt

Scan type: Full scan (C:|)
Objects scanned: 634201
Time elapsed: 1 hour(s), 28 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Detected nothing bad. =/