Windows Command Processor alteration requests.

Viruses and worms
1

Hello there,
I have the exact same problem as mentioned here, http://forum.avast.com/index.php?topic=82254.0 also can’t shake it. Can you guide me through what to do please? I should add that I haven’t clicked yes to the Windows Command Process alteration request.

Sorry to just post a link but I have exactly the same problem as outlined there. I’ve ran Malware bytes then AVG, both found virus’ but not the troublemaker. It appears in processes and the registry as bdrfjrgh.exe

Thanks very much,
Gav

2

Just getting the Mbam and OTS logs for you to look at.

3

Malwarebytes’ Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7312

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29/07/2011 23:06:18
mbam-log-2011-07-29 (23-06-18).txt

Scan type: Quick scan
Objects scanned: 191968
Time elapsed: 4 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

4

This is from before:

Malwarebytes’ Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7305

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29/07/2011 14:17:42
mbam-log-2011-07-29 (14-17-42).txt

Scan type: Full scan (C:|)
Objects scanned: 659416
Time elapsed: 2 hour(s), 12 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

5
It appears in processes and the registry as bdrfjrgh.exe
upload suspicious file(s) to www.virustotal.com and test with 43 malware scanners when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti http://virusscan.jotti.org/en
VirSCAN http://virscan.org/

6

Ok, virus total has seen it before, here is what I was given, it was under last report.

http://www.virustotal.com/file-scan/report.html?id=589d86698e42aeeeec0114165186e5c59e4e55c9c1a77868e2ae1c0b19c1c6ab-1311862233

7

Send the sample/s to avast as a Undetected Malware:
Open the chest and right click in the Chest and select Add, navigate to where you have the sample and add it to the chest (see image). Once in the chest, right click on the file and select ‘Submit to virus lab…’ complete the form and submit, the file will be uploaded during the next update. Note: manually adding to the chest doesn’t remove them from the original location, so they still have to be dealt with in that location.
Or
Send the sample to virus (at) avast (dot) com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.

8

Ok, I’ve sent that off. Thanks very much for your help.