Avira Free Event list warning for malware found

11 years ago

System: XP home, Avira Free, up to date.

Today I received a warning from Avira it had found malware. I didn't take action immediately but came back later and activated Avira Dialog/control box and clicked on "event". There I found a list of 8 detections of malware found all in a one minute period. In the middle was a warning that Autorun had blocked something, I assume an actin by Avira - maybe by the malware.

Looking for some tool, button, in Avira to remove the malware the only thing I found was "delete selected event"... I don't want to delete the even record, but think I should delete the malware. Does clicking on "delete selected event" remove the associated malware detected?

Comments (16)

ravencajun Zone 8b TX
11 years ago
I would not delete the malware yet just in case it is a false positive instead put in quarantine.
I would run an updated full malwarebytes scan, then a free online scan like eset to see what it says then run your Avila again.

Here is a link that might be useful: eset
jerry_nj
Original Author
11 years ago
Thanks, I didn't see quarantine tool in Avira - or even mention of it. I can look again.

A just completed Avira scan again turned up the 8 problems.

I do have Malware, you express a lot of confidence in that tool. I do not run it on a routine basis, perhaps I should.

"eset" is a new tool, an online scan I take it, one that offers to fix for a price? Hey, I'm okay with paying for stuff, but go free if possible.

I am not aware of any performance problems from the 8 issues on my system.
Related Discussions
is this legit? Malware question
Q
Comments (11)
some of the most common sites have fallen prey to hackers using poor code or outdated scripts on a site to put into the site a malicious link, I am talking very reputable sites and the site owners have no idea it happened till they start getting feed back telling them it is happening then they find the culprit. So never assume the site is safe just best to say well I hope it is safe but will always use caution and keep my programs updated and run those scans regularly. Do not be scared when you see something like this happen it is exactly what you want your program to do, I much prefer a false positive over the alternative! But anytime you have a question copy down the info that is provided so you can come here well informed so we can try to find out what the situation was. The name is essential because these days the rogue programs that are out there are very close in looks and names to the real programs so please do take the time to look at it closely and write down the exact name. Just to give you an idea take a look at this blog and the number of rogue infections that mimic the look and names of real security programs. Every day new ones pop up. Malwares, Rogues, Scarewares
...See More
Computer security hi-jacked - WARNING!!
Q
Comments (18)
DDS.txt . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 Run by DK at 18:12:58 on 2012-06-12 Microsoft� Windows Vista� Home Premium 6.0.6002.2.1252.1.1033.18.3062.1241 [GMT -4:00] . AV: Microsoft Security Essentials *Enabled/Updated* (9765EA51-0D3C-7DFB-6091-10E4E1F341F6) SP: Windows Defender *Disabled/Updated* (D68DDC3A-831F-4fae-9E44-DA132C1ACF46) SP: Microsoft Security Essentials *Enabled/Updated* (2C040BB5-2B06-7275-5A21-2B969A740B4B) . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss c:\Program Files\Microsoft Security Client\MsMpEng.exe C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files\SUPERAntiSpyware\SASCORE.EXE C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe C:\Program Files\Common Files\Intuit\DataProtect\QBIDPService.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\hkcmd.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\rundll32.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE C:\Windows\system32\svchost.exe -k SDRSVC C:\Users\DK\AppData\Local\Google\Chrome\Application\chrome.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Link Helper: (18df081c-e8ad-4283-a596-fa578c2ebdc3) - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: (53707962-6f74-2d53-2644-206d7942484f) - c:\program files\spybot - search & destroy\SDHelper.dll BHO: Groove GFS Browser Helper: (72853161-30c5-4d22-b7f9-0bbc1d38a37e) - c:\progra~1\micros~2\office14\GROOVEEX.DLL BHO: Java(tm) Plug-In SSV Helper: (761497bb-d6f0-462c-b6eb-d4daf1d92d43) - c:\program files\java\jre6\bin\ssv.dll BHO: Office Document Cache Handler: (b4f3a835-0e21-4959-ba22-42b3008e02ff) - c:\progra~1\micros~2\office14\URLREDIR.DLL BHO: Java(tm) Plug-In 2 SSV Helper: (dbc80044-a445-435b-bc74-9c25c1c588a9) - c:\program files\java\jre6\bin\jp2ssv.dll TB: (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - No File TB: (2318C2B1-4965-11D4-9B18-009027A5CD4F) - No File uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey uPolicies-explorer: HideSCAHealth = 1 (0x1) mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: ConsentPromptBehaviorUser = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000 IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105 IE: (2670000A-7350-4f3c-8081-5663EE0C6C49) - (48E73304-E1D6-4330-914C-F5F514E3486C) - c:\program files\microsoft office\office14\ONBttnIE.dll IE: (789FE86F-6FC4-46A1-9849-EDE0DB0C95CA) - (FFFDC614-B694-4AE6-AB38-5D6374584B52) - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll DPF: (8AD9C840-044E-11D1-B3E9-00805F499D93) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA) - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: (E2883E8F-472F-4FB0-9522-AC9BF37916A7) - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab TCP: DhcpNameServer = 192.168.1.1 71.242.0.12 TCP: Interfaces\(331C4984-7B67-4895-92BF-FBD07719C629) : DhcpNameServer = 192.168.1.1 71.242.0.12 Filter: text/xml - (807573E5-5146-11D5-A672-00B0D022E945) - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Handler: intu-help-qb5 - (867FCB77-9823-4cd6-8210-D85F968D466F) - c:\program files\intuit\quickbooks 2008\HelpAsyncPluggableProtocol.dll Handler: qbwc - (FC598A64-626C-4447-85B8-53150405FD57) - c:\windows\system32\mscoree.dll Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SEH: Groove GFS Stub Execution Hook: (b5a7f190-dda6-4420-b3ba-52453494e6cd) - c:\progra~1\micros~2\office14\GROOVEEX.DLL SEH: SABShellExecuteHook Class: (5ae067d3-9afb-48e0-853a-ebb7f4a000da) - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 171064] R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664] R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2011-5-4 116608] R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504] R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2011-7-1 290832] R2 QBVSS;QBIDPService;c:\program files\common files\intuit\dataprotect\QBIDPService.exe [2011-8-19 1248256] R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-10 4640000] R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8187B.sys [2011-6-14 281088] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-18 257696] S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880] S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2011-4-27 74112] S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2012-06-12 20:05:54 56200 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(c63b0218-fda0-4f49-a66a-fbbac2d29431)\offreg.dll 2012-06-12 14:38:15 713784 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\nisbackup\gapaengine.dll 2012-06-12 14:38:15 713784 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(94e954c4-9303-4459-aace-f4d82ef5da4b)\gapaengine.dll 2012-06-12 14:36:16 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\(c63b0218-fda0-4f49-a66a-fbbac2d29431)\mpengine.dll 2012-06-12 01:09:54 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2012-05-16 22:05:38 677136 ----a-w- c:\programdata\microsoft\ehome\packages\mcespotlight\mcespotlight\SpotlightResources.dll . ==================== Find3M ==================== . 2012-05-04 17:57:10 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2012-05-04 17:57:09 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2012-04-04 19:56:40 22344 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-04-03 08:16:12 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-03 08:16:11 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-04-02 13:36:21 2044928 ----a-w- c:\windows\system32\win32k.sys 2012-03-30 12:39:11 914304 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-03-29 13:39:19 31232 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2012-03-25 17:34:20 472808 ----a-w- c:\windows\system32\deployJava1.dll 2012-03-21 00:44:12 74112 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys 2012-03-21 00:44:12 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2012-03-20 23:28:50 53120 ----a-w- c:\windows\system32\drivers\partmgr.sys . ============= FINISH: 18:13:49.82 =============== Attach.txt . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft� Windows Vista� Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 6/14/2011 9:30:53 PM System Uptime: 6/12/2012 4:29:45 PM (2 hours ago) . Motherboard: Gateway : : Processor: Intel(R) Pentium(R) Dual CPU T2370 @ 1.73GHz : U2E1 : 1333/mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 298 GiB total, 207.691 GiB free. D: is CDROM () E: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP405: 5/23/2012 11:07:30 AM - Windows Update RP406: 5/24/2012 1:57:24 PM - Windows Update RP407: 5/25/2012 5:02:37 PM - Windows Update RP408: 5/26/2012 5:59:33 PM - Windows Update RP409: 5/27/2012 6:32:30 PM - Windows Update RP410: 5/28/2012 7:53:40 PM - Windows Update RP411: 5/29/2012 11:27:49 AM - Windows Update RP412: 5/30/2012 12:05:57 PM - Windows Update RP413: 5/31/2012 12:35:48 PM - Windows Update RP414: 6/1/2012 5:13:40 PM - Windows Update RP415: 6/2/2012 10:49:47 AM - Windows Update RP416: 6/3/2012 6:47:47 PM - Windows Update RP417: 6/4/2012 11:25:04 AM - Windows Update RP418: 6/4/2012 10:49:10 PM - Windows Update RP419: 6/5/2012 4:54:34 PM - Windows Update RP420: 6/6/2012 9:34:37 AM - Scheduled Checkpoint RP421: 6/6/2012 11:11:02 AM - Windows Update RP422: 6/7/2012 10:32:10 AM - Scheduled Checkpoint RP423: 6/7/2012 12:15:48 PM - Windows Update RP425: 6/7/2012 10:23:25 PM - Microsoft Antimalware Checkpoint RP426: 6/8/2012 4:39:47 PM - Windows Update RP427: 6/9/2012 4:43:40 PM - Windows Update RP428: 6/10/2012 7:42:19 PM - Windows Update RP429: 6/11/2012 9:08:02 PM - Windows Update RP430: 6/12/2012 10:34:30 AM - Windows Update RP432: 6/12/2012 11:29:23 AM - Microsoft Antimalware Checkpoint RP433: 6/12/2012 5:35:38 PM - Windows Backup . ==== Installed Programs ====================== . Adobe AIR Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe Flash Player 11 ActiveX Adobe Fonts All Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS3 Adobe Reader X (10.1.3) Adobe Setup Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Brother MFL-Pro Suite MFC-490CW Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Google Chrome Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) IHA_MessageCenter Intel(R) Graphics Media Accelerator Driver Intel(R) Matrix Storage Manager Java Auto Updater Java(TM) 6 Update 31 Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft IntelliPoint 8.1 Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Security Client Microsoft Security Essentials Microsoft SQL Server Compact 3.5 SP1 English Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Word 2002 Microsoft Works 2002 Setup Launcher Microsoft Works 6.0 Microsoft Works Suite Add-in for Microsoft Word MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK PaperPort Image Printer PDF-XChange Viewer PDF Settings PHOTOfunSTUDIO 5.0 QuickBooks QuickBooks Pro 2012 REALTEK RTL8187SE Wireless LAN Driver REALTEK USB Wireless LAN Driver Samsung Kies SAMSUNG USB Driver for Mobile Phones ScanSoft PaperPort 11 Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2656351) Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio Viewer 2010 (KB2597981) 32-Bit Edition Spybot - Search & Destroy 1.4 SUPERAntiSpyware SupportSoft Assisted Service Synaptics Pointing Device Driver Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Extended (KB2468871) Update for Microsoft .NET Framework 4 Extended (KB2533523) Update for Microsoft .NET Framework 4 Extended (KB2600217) Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition Vz In Home Agent WhoCrashed 3.04 WinRAR 4.01 (32-bit) Works Suite OS Pack Works Synchronization . ==== Event Viewer Messages From Past Week ======== . 6/6/2012 11:19:35 AM, Error: Microsoft-Windows-PrintSpooler [6161] - The document CMO signed.pdf, owned by EC, failed to print on printer Brother MFC-490CW Printer. Try to print the document again, or restart the print spooler. Data type: NT EMF 1.008. Size of the spool file in bytes: 4007636. Number of bytes printed: 3175820. Total number of pages in the document: 3. Number of pages printed: 0. Client computer: \\DK-PC. Win32 error code returned by the print processor: 87. The parameter is incorrect. 6/12/2012 3:48:39 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. 6/12/2012 2:45:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: (E60687F7-01A1-40AA-86AC-DB1CBF673334) 6/12/2012 2:25:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: (145B4335-FE2A-4927-A040-7C35AD3180EF) 6/12/2012 2:20:45 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: MpFilter SASDIFSV SASKUTIL spldr Wanarpv6 6/12/2012 2:20:45 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 6/12/2012 2:19:56 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: (9E175B6D-F52A-11D8-B9A5-505054503030) 6/12/2012 2:19:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: (1BE1F766-5536-11D1-B726-00C04FB926AF) 6/12/2012 2:19:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: (DD522ACC-F821-461A-A407-50B198B896DC) . ==== End Of File ===========================
...See More
Spyware found
Q
Comments (34)
Yes, I do feel better about my computer security, but truthfully will feel a lot better when I get it all sorted out. Is it just me, or do you have to be a rocket scientist to understand SpywareBlaster? lol First of all, under Protection Status, Internet Explorer Protection, I ticked off both Active X Protection and Cookie Protection not being sure if I should do that. ie. Do I want to protect my PC from ALL Active X and ALL cookies? I just left the 'Block List' alone since SpywareBlaster has 355 items selected, and since I don't know what I want to block or not block. After doing this, Internet Explorer Protection is 'partially enabled'. I don't know if that's what I should have. I have protection enabled for Restricted Sites - that, I think I understand. Do I want to do a System Snapshot? And with the Secunia, when I downloaded it I set it to automatically update out-of-date programs. Should I have selected that option, or should I manually update out-of-date programs that it finds? To respond to your recommendations (and thank you for making them), near: 1. I do have Windows set to automatically update, so I'm good on that. I checked up update history, and the only updates it recommends at this time are 7 optional ones. I never done the optional updates. 2. I'm seeing more and more recommendations for the MSE. So it only updates and runs once a week and not daily. I guess this is sufficient? I'm not sure if I'm going to switch over my AVG for something else, but MSE is in the running. 3. Check, on the MalwareBytes. Do you usually run a full scan or a Quick Scan? I've been running the full scan mostly. 4.Check, on the SpywareBlaster (but I have the above questions on it). I still haven't downloaded the SuperAntispyware. 5. I downloaded the Secunia. 6. I haven't downloaded the WinPatrol yet. I have been wondering if AVG will have a problem with it, or vice versa. But we'll see.
...See More
Skype or malware/virus question
Q
Comments (6)
you got hit with a misdirect for the dreaded antivirusxp infection. Many many sites even legit sites have been having these misdirections occurring, the best thing you can do is not click anything but just close the browser out, if you click on any part of it that begins the install, it sounds like your WOT saved you. But I would definitely run malwarebytes and superantispyware daily for a few days (update them of course) and do a separate online virus scan also. Online Virus Scan you must run it with IE. are you still seeing anything strange or any warnings from down by the clock? remember do not click on any part of it, if you have to shut down the pc instead do that.
...See More
grandms
11 years ago
No, eset is not one that "offers to fix for a price". If it were, no one on this forum would recommend it.
ravencajun Zone 8b TX
11 years ago
I specifically said Free online scan I wouldn't tell you to use something you would pay for.
The reason for that scan is because it does not reside on the computer therefore any infection on the computer will not be able to affect the results.

Yes I do recommend malwarebytes often the reason why is because it is one of the best available for malware detection and removal,and yes if you care about your computer security you should update and run it on a regular basis thats why we suggest that so often.

You can have no idea what an infection is doing on your computer thats why they make them to hide themselves! Stealth is exactly what they want so they can continue unnoticed.

Will you list the names of the threats found you should be able to copy and paste here.
ravencajun Zone 8b TX
11 years ago
here is another Free online virus scan see if it is more to your liking.

Here is a link that might be useful: bitdefender
jerry_nj
Original Author
11 years ago
Thanks "eset" is running right now, at about 50% point and has been running for 1.5 hours.

I am running under Internet Explorer, eset has some "problem" with Firefox? I don't recall the specifics but I think it needs IE to be able to run online. Not a problem I have IE on my computers too.

Here's the end of the Avira scan that I think is connected to the subject 8 warnings. There's a lot more in the report that seem to say okay.
----------------------
Starting to scan executable files (registry).
The registry was scanned ( '3350' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\Documents and Settings\Owner\Local Settings\Temp\(17AC6C49-9AE0-4581-AFAA-13224ED6462C)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
C:\Documents and Settings\Owner\Local Settings\Temp\(5821FAD0-6894-45C1-AAFB-D32B9423435D)-23.0.1271.97_23.0.1271.95_chrome_updater.exe
[WARNING] The file could not be read!
C:\Documents and Settings\Owner\Local Settings\Temp\(B8928193-F191-4B7F-B89E-6EAF7FADC16E)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
C:\Documents and Settings\Owner\Local Settings\Temp\(D257853B-297C-4E24-AEDF-26ED58C00808)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
C:\Documents and Settings\Owner\Local Settings\Temp\(D76F404B-D7AF-43F5-9F6C-6265674C830D)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
C:\Documents and Settings\Owner\Local Settings\Temp\(E6E69F8A-88A8-4051-994D-5A9C61E36424)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
C:\Documents and Settings\Owner\Local Settings\Temp\(EF9FCAFC-07F2-49EE-894C-ABE0CD9FB94B)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
C:\WINDOWS\SoftwareDistribution\Download\54f4ff5bcddfaea7a9fb4fc69f0ed394\BITC.tmp
[0] Archive type: CAB (Microsoft)
--> _sfx_0000._p
[WARNING] The file could not be written!
Begin scan in 'D:\'

End of the scan: Wednesday, January 09, 2013 14:36
Used time: 2:06:15 Hour(s)

The scan has been done completely.

14848 Scanned directories
796921 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
796921 Files not concerned
12780 Archives were scanned
8 Warnings
6 Notes
792424 Objects were scanned with rootkit scan
6 Hidden objects were found
owbist
11 years ago
See what eset brings up. But if you are not satisfied I would suggest running Avira in Safe mode as 7 of those 8 items refer to Chrome, chrome would not be runing in safe mode so the files should not be protected I think.... Either that or do away with Chrome.
jerry_nj
Original Author
11 years ago
eset ran for 2 hours and 16 minutes and didn't find any problems. Malware full scan is now running.

I noticed Avira come up with problems several times while eset was running. They all had the general content:
Security Alert
C:\windows\SoftwareDistribution\....\bita2.tmp
and offering me either "details" or "Remove"
I picked remove which caused a Avira "System is being scanned" display which completed in perhaps 1 minute. "bita.3.tmp" was another problem file and I didn't note what was going on before, my guess is it was "bita1.tmp"
ravencajun Zone 8b TX
11 years ago
The concerning part is the part under rootkit scan that shows 6 hidden items.
jerry_nj
Original Author
11 years ago
I updated to Advanced System Care 6 and it "cleaned" out a bunch of "stuff/problems". It also installed a boot-start Performance Monitor which displays CPU, Disk, Memory, Network in % of usage. The CPU is stuck at 100%, this doesn't seem right to me. The other seem reasonable, RAM running at about 70% and Disk very low usage.

I recall IObit Advanced System Care has some distractors on the forum, and I have made very little use of it but given the concerns of this thread I decided to update and run a scan. I can look for the "start-up" list and remove it if the Performance Monitor or other ASC running is eating a lot of CPU resources.

I'll run a Avira scan again to see if it still posts warnings. As noted earlier, I began to hit the "Remove" on the Avira pop-up warnings, this didn't seem to help, the pop-ups continued. So, I clicked on "details" this gave me a dialog box that allowed me to quarantine the subject item.
zep516
11 years ago
"allowed me to quarantine the subject item."

What subject item are you referring to?
jerry_nj
Original Author
11 years ago
When Avira causes a pop-up warning (from the lower tool bar, RH side) to appear it gives me a choice to "remove" or "details". When I pick "remove" the dialog window drops out, a scanning progress bar comes up and completes in a minute or two.. and the warning issue seems to remain. If I click on "details" I get another dialog box that lists the item that is the subject of the warning, and when I click on it Avira offers the choice to "quarantine" which I pick. After a few of these an Avira scan shows no warnings, seems to suggest to me the "details -> quarantine" sequence eliminates the "subject" virus/malware/whatever.
zep516
11 years ago
Are you getting constant pop ups from Avira then?

Is Avira still seeing this below?

C:\Documents and Settings\Owner\Local Settings\Temp\(17AC6C49-9AE0-4581-AFAA-13224ED6462C)-23.0.1271.64_22.0.1229.94_chrome_updater.exe
[WARNING] The file could not be read!
jerry_nj
Original Author
11 years ago
The pop ups have stopped - I noted in this thread actions taken within Avira to Quarantine, this and perhaps other programs removed most problems.... Avira scan still shows one warning.

The message you highlight is no longer in the report.

The Avira report does still show some invisible reports:
1)

Starting search for hidden objects.
HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Dhcp\Parameters\(2B5F6C3E-2721-4967-A64D-004C9F1332D3)
[NOTE] The registry entry is invisible.
C:\Documents and Settings\NetworkService\Cookies
C:\Documents and Settings\NetworkService\Cookies
[NOTE] The registry entry is invisible.
C:\WINDOWS\system32\config\systemprofile\Desktop
C:\WINDOWS\system32\config\systemprofile\Desktop
[NOTE] The registry entry is invisible.
C:\WINDOWS\system32\config\systemprofile\My Documents
C:\WINDOWS\system32\config\systemprofile\My Documents
[NOTE] The registry entry is invisible.
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files
[NOTE] The registry entry is invisible.
C:\Documents and Settings\NetworkService\Local Settings\History
C:\Documents and Settings\NetworkService\Local Settings\History
[NOTE] The registry entry is invisible.

-----------------
and concludes with one warning continuing:

End of the scan: Saturday, January 12, 2013 00:30
Used time: 1:52:54 Hour(s)

The scan has been done completely.

13847 Scanned directories
795456 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
795456 Files not concerned
11909 Archives were scanned
1 Warnings
6 Notes
787853 Objects were scanned with rootkit scan
6 Hidden objects were found
zep516
11 years ago
I don't see an issue or any malware related files. Avira always has the hidden objects in it's scan report .

C:\WINDOWS\system32\config\systemprofile\Desktop
C:\WINDOWS\system32\config\systemprofile\Desktop

Why are those on the desktop?

You could visit the Avira forum and see what they say.

I don't see any related Malware issue.

How is the computer running?
jerry_nj
Original Author
11 years ago
Zep, the computer is running normally (for a 5 yo notebook). I didn't notice any change in operation other than the pop ups from Avira - that has stopped following my clicking on "details" then "quarantine" for each of them. I ran other programs to remove spyware and malware but I don't know exactly which did what.

Thanks

Avira Free Event list warning for malware found

Comments (16)

ravencajun Zone 8b TX

jerry_nj
Original Author

Related Discussions

grandms

ravencajun Zone 8b TX

ravencajun Zone 8b TX

jerry_nj
Original Author

owbist

jerry_nj
Original Author

ravencajun Zone 8b TX

jerry_nj
Original Author

zep516

jerry_nj
Original Author

zep516

jerry_nj
Original Author

zep516

jerry_nj
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Avira Free Event list warning for malware found

Comments (16)

jerry_njOriginal Author

Related Discussions

jerry_njOriginal Author

jerry_njOriginal Author

jerry_njOriginal Author

jerry_njOriginal Author

jerry_njOriginal Author

jerry_njOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

jerry_nj
Original Author

jerry_nj
Original Author

jerry_nj
Original Author

jerry_nj
Original Author

jerry_nj
Original Author

jerry_nj
Original Author

jerry_nj
Original Author