win32:RmnDrp & JS:agent-DRW

Viruses and worms
1

first, sorry for my bad english

so, this morning i got some report from avast, it said some of my program had infected, then i started to scan my computer. the results some of my programs had infected by win32:RmnDrp and JS:agent-DRW. some of programs can be repair/delete by avast, but some programs which infected by JS:agent-DRW cant be repair or delete. so i try to boot-time scan but only 1 threat had been detected, then i try to scan again but there is no programs had infected. that make me confuse

i want to make sure those virus has gone

2

https://forum.avast.com/index.php?topic=53253.0

3

where i must attach these logs?

4

In this topic.

5

i cant open the FRST.exe even i’ve choose compatible version. is it take a long time to can be open?

6

By “I can’t Open,” do you mean that you chose to download and Open in one action ?

I tested the download and Open option and it span its wheels for ages, so much so that it locked my system and the only way out was a Hard Reboot.

So avast could be getting involved by scanning it and this would get in the way of the download. You should elect to Save the file rather than Open for the download.

7

It must reside on the desktop and not run from a temp folder

8

i’ve place it on my desktop but it still can’t be open, is there any optional program? i tried to hard boot my computer but it still won’t to open, must i download it again? or is it okay to attach logs without logs from FRST?

9

i have new issue, my avast can’t be update or repair, but finally i can open FRST, here they are

10

You need to remove Norton which is still running on your system

Download and run the tool from here https://support.norton.com/sp/en/us/home/current/solutions/kb20080710133834EN_EndUserProfile_en_us

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-1949455725-2185752814-636339979-1000\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-1949455725-2185752814-636339979-1001\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2614272 2009-10-31] (Microsoft Corporation) <==== ATTENTION S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X] S3 EagleNT; \??\C:\Users\P8H61-~1\AppData\Local\Temp\EagleNT.sys [X] S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X] R3 gkernel; \??\C:\Users\P8H61-~1\AppData\Local\Temp\gkernel.sys [X] S3 XDva413; \??\C:\Windows\system32\XDva413.sys [X] S3 XDva422; \??\C:\Windows\system32\XDva422.sys [X] S3 XDva424; \??\C:\Windows\system32\XDva424.sys [X] S3 XDva511; \??\C:\Windows\system32\XDva511.sys [X] Task: {919ED399-62CA-4099-AE71-F0A63A56C7D3} - System32\Tasks\Baidu PC Faster Update => $szInstallingDir\Updater.exe Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

11

is this will fix my avast update too?

here the log

12

Once you have removed Norton then try to update avast, let me know how that goes

13

still didn’t work, here i attach the setup log

14

OK go for a clean install of Avast

Download Avast Uninstall Utility to your Desktop.
Download the correct version of Avast
Avast Free
Avast Pro
Avast Internet Security
Avast Premier
Disconnect from the net
Uninstall Avast via control panel

[]Run the uninstall tool and accept the reboot to safe mode
[]Once complete reboot your system
[*]Reinstall Avast

15

okay thanks for your help, i think my that’s fix my avast issue, and my computer clear from any virus right?

16

It appears to be, how is the computer behaving

17

it seems nothing wrong for now, i will try open some application later because those virus infected some of my program’s file and avast deleted some of file which infected

18

If you still have problems we could try a USB based cleaner