Trojan Possibly Crashing Avira?

Fire_Fox

:j I have fixed the hotkey entries and successfully run a Dr. Web express scan with NO turning off incidents!! :j It found the EICAR test file but nothing else: will run the complete scan now ...

Fire_Fox

After a marathon five hour complete scan, Dr. Web has found two EICAR test files and two adware.coupons.34 but it seems to think they are all incurable. Shall I try Combofix again?

aliEnRIK

If theyre incurable then it should give the option of 'moving' (Quarantining them)

Either way, sure, give combofix another try

Fire_Fox

Xxxxxxxxxxxxxxxxxxxx

Fire_Fox

Xxxxxxxxxxxxxxxxxxxxxx

Fire_Fox

:beer: Thank you very much aliEnRIK, I am chuffed to bits that you have got my lappy so far.

aliEnRIK

Your definitely still infected



Open notepad and copy/paste the text in RED below

File::
c:\windows\system32\RMActivate_isv.exe
c:\windows\system32\RMActivate.exe
c:\windows\system32\secproc_isv.dll
c:\windows\system32\secproc_ssp_isv.dll
c:\windows\system32\secproc_ssp.dll
c:\windows\system32\secproc.dll
c:\windows\system32\msdrm.dll
c:\windows\system32\RMActivate_ssp_isv.exe
c:\windows\system32\RMActivate_ssp.exe
c:\programdata\SPL929D.tmp
c:\programdata\SPL11FA.tmp
c:\programdata\SPL7A2E.tmp
c:\programdata\SPL3DD1.tmp




Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.

Fire_Fox

Xxxxxxxxxxxxxxxxx

Fire_Fox

Xxxxxxxxxxxx

aliEnRIK

Intriguing.
Open malwarebytes
Goto MORE TOOLS
then RUN TOOL
manually find and delete these (If possible)
c:\windows\system32\secproc_isv.dll
c:\windows\system32\secproc_ssp_isv.dll
c:\windows\system32\secproc_ssp.dll
c:\windows\system32\secproc.dll
c:\windows\System32\drivers\pavboot.sys
c:\windows\System32\drivers\nnrnstdi.sys