win32:malware-gen

Viruses and worms
1

Hi, I have premier for 3 PC’s
My daughters PC got the win32:malware-gen which has infected her schoolwork + program files + C:\windows\installer :cry:
on a startup scan avast ask if I want to put it in sanbox etc.
but I don’t know if that will destroy the computer so it can’t start up again?
Anyone who can advise me? thank you

2

the best would be to go back to an image of the operating system.

3

sorry, I don’t understand?

4

do you have any kind of backup a) from your data and b) from your operating system and your installed applications?
That would help faster than any other kind of experiments …

5

No she doesn’t have backup :frowning:
When the start up scan was done it asked if I wanted to delete the files. I am afraid it will remove the windows totally as it is the windows installer that is infected, so I didn’t do anythng.
I don’t know if the antivirus is so advanced that it won’t break the OS

6

did avast detect this all by itselfe, or did you run a scan and then it was detected

When the start up scan............
I assume you mean boot time scan? Why did you run boot time scan?
7

I renewed my license and when I wanted to make her computer ready then Avast didn’t work. It was Off… I tried to fix it but something didn’t let it start so I downloaded it again and then did a boot scan and then hell broke lose… so many files are currupted I canøt even remember them all they just kept coming.
so somehow that virus shut Avast off at one point. I have no idea how long ago that happened or how

8

I suggest you start here to find out what this is

Instructions >> https://forum.avast.com/index.php?topic=194892.0

attach the requested logs

9

Ok, thank you :slight_smile: I will do this when she comes back tomorrow after exam.

10

I’ll be interested to read what the experts here glean from the requested logs.

What bet the PC was not infected with anything and this was caused by AVAST deleting some important system files as false positives?

Win32: malware-gen is not a virus it is used as a general term for anything detected as malware by AVAST and unfortunately that can included many false positives. If AVAST is allowed to delete them, which it will do if you choose the default option “Fix Automatically” when running a boot time scan, it can leave a system crocked.

I’m not saying that is the case here, the PC might be infected, but anyone reading this in the future with similar woes: if AVAST is not working that is the time to post here and ask for advice, not do a boot time scan to try to fix a system that might not even be infected.

Depending on the advice provided here once the logs are investigated: if the PC is still bootable I’d take it offline, isolate it from any network connections and suggest going into Safe Mode and running Malwarebytes or even a free Kaspersky live disc to discover if the system really is infected.

Then, unfashionable though it is and bearing in mind that whatever AVAST/the OP has now done will probably have stuffed up the chances of that working, I’d actually try using a Restore Point.

11

Right - gen stands for generic and means an unspecific class of questionable files.

12

Generic is a detection algoritme that look fore program or file that has features or behaviors similar to known harmful programs

If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.

13

There was nothing. I used malwarebytes from the link you gave me and it say no threat detected.
I am very pleased to read that but I am puzzled to why Avast say there are problems when doing a boot test.
We have ASUS computers so maybe it could be the auto update they had which was hacked last year?
Do you still want me to post the log from malwarebytes?

14

her computer is still running. I pressed cancel when avast asked if I wanted to delete the files as she has exam every week from now till june o.O so I had no interest in destroying her work LOL so I cancelled and came here to ask :slight_smile: Luckily! :slight_smile:
Still wonder though… ASUS had auto updates last year. I read they were hacked and came with some virus or something. But malwarebytes say there are no threats

15

The general advice given in this forum is, or at least was, not to do boot time scans except when prompted by AVAST or on the recommendation of one of the genuine experts here. I took that advice on board and stuck with it and so that’s the advice I passed on.

It is easy to believe a system is infected when you get a slew of reports from a trusted AV program telling you that it is but acting on that without getting advice is not a good idea. You should always treat such information seriously but do that in the knowledge AVs are not infallible.

In this case we still do not know what caused the Win32: malware-gen reports do we? However, that there is apparently no problem on your daughter’s PC is good news.

16

Ya, I will take that advice too :slight_smile:
No I have no idea what caused it. Avast still claim it’s there but with malwarebytes there are no threats, so I will let it be

17
Avast still claim it's there but with malwarebytes there are no threats, so I will let it be
have you tried to upload and check some of the detected files at www.virustotal.com Post [b]link[/b] to scan result(s) here

you have not attached logs from the help guide, the two diagnostic logs from step #2 FRST are the important ones

18

While it is true that the detection “Malware-gen” isn’t always the most reliable, it isn’t something to ignore, especially when combined with the fact that Avast! had been disabled (what caused that isn’t mentioned). It could’ve been that the license lapsed or something.

Really, before anyone can say anything, we need to see actual log files…

OP, I would highly recommend you attach the requested log files, (FRST, MBAM), so someone can take a look at them. (As recommended by Pondus.)