[maliprog]

Hi Liv Scott,

Sorry for delay...

I'm not sure where we stand right now. How do you wont to proceed?

[Advertisements]

No worries-I was just wondering if you thought anything I downloaded could have caused the virus, or if it was just bad luck.

I can attempt to download another version of Avaast removal software-I need to download files urgently, and I trust you, I was just concerned because of the timing of the virus.

[Liv Scott]

No worries-I was just wondering if you thought anything I downloaded could have caused the virus, or if it was just bad luck.

I can attempt to download another version of Avaast removal software-I need to download files urgently, and I trust you, I was just concerned because of the timing of the virus.

[maliprog]

All this files are from legal source. I use it for years and this files are all from trusted source.

Please don't use any type of USB memory to transfer files between these PC's because you could transfer malware too.

So I downloaded the application, but I got an error message that said it was not a valid win32 application...

Can you try to download it again. You must try do download tools on this PC from now. Don't try to transfer tools between computers from now on.

[Liv Scott]

My apologies! I haven't had any other way of getting the programs onto my computer, but I'll definitely stop!

I tried downloaded aswclear.exe again, this time from this computer, and got this again
“Windows cannot find ‘D:\Users\Livsie\Downloads\aswclear.exe.’ Make sure you typed the name correctly, and then try again.”

[Liv Scott]

You know, I had a thought-maybe I should use the regular Avast uninstall, and then I can try to download aswclear again to get rid of the remnants of Avast? Anyway, just a thought! Happy New Year!

Another unfortunate update-when I turned on my computer this morning, Avast asked me to confirm an update-I had accidentally started updating it the night before but remembered and canceled it instantly, so I definitely messed up. Then now, I just restarted my computer-and Avast had added an extension to Chrome.

Edited by Liv Scott, 02 January 2013 - 12:35 AM.

[maliprog]

You know, I had a thought-maybe I should use the regular Avast uninstall, and then I can try to download aswclear again to get rid of the remnants of Avast? Anyway, just a thought! Happy New Year!

First of all... Happy new year!

Next... Try to uninstall AVAST from Control panel and let me know results.

[Liv Scott]

okay I uninstalled Avast (I turned on Windows Defender after so I have some protection), but I still can't download aswclear, I got the same error message

[maliprog]

I still can't download aswclear, I got the same error message

Can you download anything now in any web browser?

[Liv Scott]

Just tried Firefox and IE
-Firefox still pretends to download it, then when I click to open the file in the Download box the "Open" functions are grayed-out
-IE still says that the file contained a virus and was deleted

Should I re-install Avast? Scan for viruses again or maybe it's a Windows problem? This is so strange!

Edit-apparently I never turned on Windows Defender, I only thought I did! :/

Edited by Liv Scott, 06 January 2013 - 09:14 AM.

[maliprog]

Let's try AVAST again but this time we will do boot scan:

AVAST Free

Once you have it installed and it has updated, right click on it and select Open Avast! User Interface then click on Scan Computer, then on
Boot-Time Scan then Schedule Now.

Reboot and let it run a scan. It will take many hours (like overnight) and unfortunately you may need to check back with it once in a while to see if it needs an input from you. If the scan hangs that may indicate a hardware problem.

[Liv Scott]

Okay! I just realized-how can I get Avast on my computer if I can't download anything? I can use my flash drive to transfer the file from the other computer again, but I know you would rather I didn't

[maliprog]

Let's protect your USB so you can use it to transfer files between computers. We will need clean PC and USB memory to download and transfer tools to infected PC.

Do this on the clean computer:

• 1 - Flash Drive Disinfector
  Download Flash_Disinfector.exe by sUBs from here and save it to your desktop.
  
• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.
  
  Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder...it will help protect your drives from future infection.

After this download AVAST and do Boot scan. Let me know results.

[Liv Scott]

Alright so the bootscan found 11 files infected-I was able to delete 9 of them, the other 2 I THINK I deleted but I'm not sure, Avast can't find them, and the automated selected option is "Move to Chest". Now, I didn't realize how long the scan would take, and I freaked out and thought my computer had completely frozen and forced a shut down.... so I ran the boot scan again and this time I only did something when it asked. I also can't figure out how to post the log, there doesn't seem to be a way to copy/paste. I really hope I didn't mess anything up!

Should I try downloading something again?

[maliprog]

The log should be saved here:

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt

If you find it please post it here for me.

Please try to download OTL just for testing.

[Liv Scott]

Found it! Here's the log. I tried downloading OTL-got the same message as before....

01/07/2013 22:18
Scan of all local drives

File C:\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-008705.file|>I\I.class is infected by Java:Malware-gen [Trj], Deleted
File C:\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-008747.file|>bpac\a$1.class is infected by Java:Agent-BJ [Expl]
----------------------------------------
01/08/2013 07:17
Scan of all local drives

File C:\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-008747.file|>bpac\a$1.class is infected by Java:Agent-BJ [Expl], Deleted
File C:\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-008747.file|>bpac\a.class is infected by Java:Agent-BW [Trj], Deleted
File C:\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-008747.file|>bpac\b.class is infected by Java:Malware-gen [Trj], Deleted
File C:\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-008747.file|>bpac\KAVS.class is infected by Java:Agent-BM [Expl], Deleted
File C:\Windows\Temp\unp122007296.tmp|>bpac\a.class is infected by Java:Agent-BW [Trj], Deleted
File C:\Windows\Temp\unp122007296.tmp|>bpac\b.class is infected by Java:Malware-gen [Trj], Deleted
File C:\Windows\Temp\unp122007296.tmp|>bpac\KAVS.class is infected by Java:Agent-BM [Expl], Deleted
File C:\Windows\Temp\unp122146720.tmp|>101117212509118-008507.file|>ARIALUNI.TTF Error 42127 {CAB archive is corrupted.}
File C:\Windows\Temp\unp122146720.tmp|>101117212509118-008507.file Error 42125 {ZIP archive is corrupted.}
File D:\LIVSIE-PC\Backup Set 2012-09-10 162648\Backup Files 2012-09-10 162648\Backup files 28.zip|>C\Users\Livsie\AppData\Roaming\Mozilla\Firefox\Profiles\92h85qxq.default\CT2438727\Dialogs.zip|>Dialogs\NewSearchProtectorDialog\images\warning.png Error 42125 {ZIP archive is corrupted.}
File D:\LIVSIE-PC\Backup Set 2012-09-10 162648\Backup Files 2012-09-10 162648\Backup files 5.zip|>C\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-000442.file Error 42125 {ZIP archive is corrupted.}
File D:\LIVSIE-PC\Backup Set 2012-10-14 190024\Backup Files 2012-10-21 204935\Backup files 4.zip|>C\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-000442.file Error 42125 {ZIP archive is corrupted.}
File D:\LIVSIE-PC\Backup Set 2012-12-09 191240\Backup Files 2012-12-09 191240\Backup files 6.zip|>C\Users\Livsie\AppData\Roaming\AVG\Rescue\PC Tuneup 2011\101117212509118.rsc|>101117212509118-000442.file Error 42125 {ZIP archive is corrupted.}
File D:\Users\Livsie\Downloads\FLS.9.0+Crack\FLS.9.0+Crack\FLS.9.0.exe|>$TEMP\EULA.exe|>c2cdll.exe|>$TEMP\audiodgt.exe is infected by Win32:Downloader-RTQ [Trj], Deleted
File D:\Users\Livsie\Downloads\FLS.9.0+Crack\FLS.9.0+Crack\FLS.9.0.exe|>$TEMP\EULA.exe|>c2cdll.exe|>$TEMP\mvNat.exe is infected by Win32:Downloader-RTQ [Trj], Deleted
File D:\Users\Livsie\Downloads\FLS.9.0+Crack.rar|>FLS.9.0+Crack\FLS.9.0.exe|>$TEMP\EULA.exe|>c2cdll.exe|>$TEMP\audiodgt.exe is infected by Win32:Downloader-RTQ [Trj], Deleted
File D:\Users\Livsie\Downloads\FLS.9.0+Crack.rar|>FLS.9.0+Crack\FLS.9.0.exe|>$TEMP\EULA.exe|>c2cdll.exe|>$TEMP\mvNat.exe is infected by Win32:Downloader-RTQ [Trj], Deleted
File D:\Users\Livsie\Downloads\Sibelius 6\lz0-sibelius.part01.rar|>SIBELIUS.V6.HYBRID.ISO-LZ0\Sibelius6_Hybrid.iso Error 42126 {RAR archive is corrupted.}
File D:\Users\Livsie\Videos\P90X Complete Disk Collection - www.DietingHub.com\Ab Ripper X - P90X - www.DietingHub.com\P90X.DISC.12.Ab.Ripper.rar|>P90X.DISC.12.Ab.Ripper.avi Error 42126 {RAR archive is corrupted.}
File D:\Users\Livsie\Videos\P90X Complete Disk Collection - www.DietingHub.com\How To Bring It - P90X - www.DietingHub.com\P90X.DISC.00.How.To.Bring.It.rar|>P90X.DISC.00.How.To.Bring.It.avi Error 42126 {RAR archive is corrupted.}
Number of searched folders: 40616
Number of tested files: 2086775
Number of infected files: 11