Win32.rmmdrp

Viruses and worms
1

Hi!
I followed the guide of this page https://forum.avast.com/index.php?topic=53253.0
and my antivirus says that the virus (win32.rmmdrp) is infecting all exe files , these are the results that gave me the programs mentioned in the guide.
I hope someone can help me please :‘(
and i couldn´t get the aswMBR programs works :frowning: :’(

2

Did you get this after using a USB stick?

Malware experts will be back online tomorrow

3

HI this will take a few runs to clear

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-537456933-2343238034-3171832812-1000\...\Winlogon: [Shell] expstart.exe <==== ATTENTION FF Extension: Bitdefender QuickScan - C:\Users\joselin\AppData\Roaming\Mozilla\Firefox\Profiles\ttbuqynw.default-1452479479085\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2016-05-15] R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-12-21] (DT Soft Ltd) R1 EfiMon; C:\Windows\System32\Drivers\Efimon.sys [23624 2014-02-09] (360安全中心) R0 HookPort; C:\Windows\System32\Drivers\Hookport.sys [75832 2014-02-09] (360安全中心) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42272 2014-04-29] (AVG Technologies) C:\Users\joselin\newjavascript.js Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

FINALLY

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

4

:‘(
Thank you for your attention and help
but I needed to finish my work schedule and had no other pc, so I ended up reformatting my pc and changing the operating system.
Now the pc seems to have no problem but I have a big question, even if you change the system, is there a possibility that the virus is still in the pc?
and
unfortunately I had 3 USB memory connected to the pc, I guess these also ended infected and use the program McShield :’(

5
is there a possibility that the virus is still in the pc?
Not if you formated
unfortunately I had 3 USB memory connected to the pc, I guess these also ended infected and use the program McShield
Install MCShield, it will clean USB devices and protect against USB malware http://www.mcshield.net/