Win32-Malware-gen

Viruses and worms
1

Hi,

I keep getting notices about Win32-malware-gen. Avast sends them to the chest but I want the notices to stop. I read on here to down load OTL and run it. Which I did but I don’t know what to do after that. Any help would be awesome.

2

Please attach your logs.
http://forum.avast.com/index.php?topic=53253.0

3

Here’s the OTL report.

4

This should stop the alerts

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL IE - HKCU\..\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm003YYus&ptnrS=YKxdm003YYus&si=CNmwpsaK-KoCFcis7Qod2yOFTw&ptb=7787D409-7BFE-4F5D-BCAB-183575C23033&psa=&ind=2011083018&st=sb&n=77deb10a&searchfor={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:33921 IE - HKCU\..\SearchScopes\{70D46D94-BF1E-45ED-B567-48701376298E}: "URL" = http://127.0.0.1:4664/search&s=AVEYcSqbCn0UqYzT2CpwBWDR17A?q={searchTerms} IE - HKLM\..\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm003YYus&ptnrS=YKxdm003YYus&si=CNmwpsaK-KoCFcis7Qod2yOFTw&ptb=7787D409-7BFE-4F5D-BCAB-183575C23033&psa=&ind=2011083018&st=sb&n=77deb10a&searchfor={searchTerms} O2:64bit: - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\x64\BrowserConnection.dll (MusicLab, LLC) O2 - BHO: (no name) - {ab56dfde-0c14-45b3-9df6-7b0eba617870} - No CLSID value found. O2 - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\BrowserConnection.dll (MusicLab, LLC) O2 - BHO: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll () O2 - BHO: (no name) - {df22384f-cf68-4d19-969f-10423715528b} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll () O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [DATAMNGR] C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\Program Files (x86)\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) [2012/06/23 14:01:06 | 000,000,000 | ---D | C] -- C:\Users\S&L\AppData\Roaming\GetRightToGo [4 C:\Windows\Installer\{06a05f1e-f07c-9716-bd15-6be9d8d0886a}\U\*.tmp files -> C:\Windows\Installer\{06a05f1e-f07c-9716-bd15-6be9d8d0886a}\U\*.tmp -> ]

:Files
ipconfig /flushdns /c
C:\Windows\Installer{06a05f1e-f07c-9716-bd15-6be9d8d0886a}
C:\Users\S&L\AppData\Local{06a05f1e-f07c-9716-bd15-6be9d8d0886a}

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

5

Here’s the new OTL report.

6

Ok. Here’s the ComboFix report. As for the computer…well I haven’t got any more notices from avast about win32 but I looked around the internet for a couple of minutes and there were problems. I looked at a couple of pages on msn and when I’d click the link I would get a message saying that I was going to a unsecure page and do I want to do that. Then when I tried to exit out of the page it just kept multipling until I am forced to restart the computer. It seems as if I’ve traded one problem for another.

7

Could you attach the Combofix log please it will be at C:\combofix.txt

Also go to the Control Panel
Select Internet Options
Select the Advanced Tab
Click Reset Internet Explorer settings

Has that resolved the IE problem ?

8

Sorry about that. I wan’t sure which one to attach. I couldn’t find combofix.text and when I tried to find it through ComboFix the program began to re-run which I know you said was a bad thing. I’m not sure what I should be doing.

I changed the settings and so far it’s working well.

9

OK could you run combofix again please, it should be quite fast and will produce a new logg with the old fix data include

10

I re-ran it and it still didn’t give me a log.

11

Could you run a fresh OTL scan please so that I can check what it has achieved