another false positive ,or, is Avast5 duff

joe134

Hi, I installed Avast 5 the other day and got a trojan dropper immediately.Erik said it was a false positive.Well, lo and behold, another Trojan, startpage.Never had Trojans before with AVG.Is this another false positive, or is Avast 5 just not up I have posted log andhijackthis log, Would be most grateful if anyone can Help me with this problem. toRegistry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Program Files\Alwil Software\Avast5\chrome\ChromeInst.exe (Trojan.Startpage) -> Delete on reboot.
it?Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:51:16, on 13/11/2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\taskeng.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\aol\1220527232\ee\aolsoftware.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\joe\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\AOL 9.0 VRb\waol.exe
C:\Program Files\AOL 9.0 VRb\shellmon.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\Windows\System32\osk.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.uk.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.uk.acer.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1220527232\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Gadwin PrintScreen] "C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe" /nosplash
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxbk_device - - C:\Windows\system32\lxbkcoms.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: MozyHome Backup Service (mozybackup) - Unknown owner - C:\Program Files\MozyHome\mozybackup.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 9583 bytes

JJ_Egan

Without recommending AVG you should be aware that false positives are more likely with AVs that use heuristic and proactive scanning . In effect looking for looks like pattern of a trojan .

jje

joe134

JJ_Egan wrote: »

Without recommending AVG you should be aware that false positives are more likely with AVs that use heuristic and proactive scanning . In effect looking for looks like pattern of a trojan .

jje

Hi jj, lost me a bit there. Are you saying that Avast is more likely to show more false positives than AVG because of the way it works? Am I right in thinking that you are not as anti AVG as some others on this site. The thing is , The AV is not detecting it, Malwarebytes is.

GunJack

that, to me, looks like a hangover from the latest avast installer where you have to untick the box to not install chrome/google toolbar etc.

tbh, I would download the avast installer http://www.filehippo.com/download_avast_antivirus/ to your desktop, disconnect from internet, uninstall current version, then run the fresh installer MAKING SURE YOU UNTICK ALL THE GOOGLE/CHROME OPTIONS as you go through the install process. Once done, reconnect to the net and update.

AVG really is carp, though, avast is good stuff (once you've got it installed and set up right )

joe134

GunJack wrote: »

that, to me, looks like a hangover from the latest avast installer where you have to untick the box to not install chrome/google toolbar etc.

tbh, I would download the avast installer http://www.filehippo.com/download_avast_antivirus/ to your desktop, disconnect from internet, uninstall current version, then run the fresh installer MAKING SURE YOU UNTICK ALL THE GOOGLE/CHROME OPTIONS as you go through the install process. Once done, reconnect to the net and update.

AVG really is carp, though, avast is good stuff (once you've got it installed and set up right )

Hi GunJack, When I installed Avast from Filehippo, It didnt, give me time to unclick Chrome, it just did it.What,s the best way to disconnect laptop from net, to instal.wireless. I did NOT do that last time::tut tut

aliEnRIK

Its just another false positive by malwarebytes. It doesnt matter as the program has done its job

joe134

aliEnRIK wrote: »

Its just another false positive by malwarebytes. It doesnt matter as the program has done its job

Hi EnRIK, thanks again, you're a star.I have noticed that since installing Avast, I get a dialoue box on strart up tray, "windows has blocked program", and it turns out to be, Malwarebytes.AVG never did that, ever.I've never seen Malwarebytes on startup tray.:beer:

spg_SCOTT

joe134 wrote: »

Hi GunJack, When I installed Avast from Filehippo, It didnt, give me time to unclick Chrome, it just did it.What,s the best way to disconnect laptop from net, to instal.wireless. I did NOT do that last time::tut tut

The avast! policy is regarding Chrome is Opt-in. That is that to install Chrome, you have to choose to. Nothing is ticked, you get a Yes/No question regarding Chrome, you have to choose, nothing is chosen for you.

You should see a prompt for Chrome, similar to the image here:
http://forum.avast.com/index.php?topic=53980.msg457414#msg457414

http://blog.avast.com/2009/12/03/avast-and-google-chrome/

And to be clear here since I think some readers were reading too much into this entry. We are not forcing Chrome on users. It is entirely up to the user–to download/install is entirely up to the user and nothing is hidden.

As for the MBAM detection, aliEnRIK is right, it is a false positive.

joe134

spg_SCOTT wrote: »

The avast! policy is regarding Chrome is Opt-in. That is that to install Chrome, you have to choose to. Nothing is ticked, you get a Yes/No question regarding Chrome, you have to choose, nothing is chosen for you.

You should see a prompt for Chrome, similar to the image here:
http://forum.avast.com/index.php?topic=53980.msg457414#msg457414

http://blog.avast.com/2009/12/03/avast-and-google-chrome/
As for the MBAM detection, aliEnRIK is right, it is a false positive.

Hi Scott, Thanks for reply.I can assure you, I did not opt in, as I have just taken Chrome off.So Avast are not truthful.If I had been given the time," A second," to read the choice, If there was one, I would have opted out, as it was, I did nothing but allow the progam to instal itself.which it did successfully.but with Chrome on my system, as you can see,Thanks for confirming EnRIK's deission, much appreciated.PS, Chrome is no big deal, I can always uninstal it.It's the false positives, 2 in 1 week.only since Avast was put on.

spg_SCOTT

Joe,

Apologies...intrigued by your post, I decided to install avast! free again in a VM. I now know that things have changed...
That image in the post in the avast! forums was when i first installed avast! 5 on release...now you see something different.

Now in installation, you see this (easy to miss if you aren't really paying attention):
https://dl.dropbox.com/u/3105891/Pics/OPT-OUT.png

To be honest, I am a little dissappointed...as you can see from my link above I frequent the avast! forum, and when the idea of chrome was being discussed, the main selling point was that it would be opt-in. Now that has changed...Before, not only was it opt-in, but it would stop the installation until you chose yes or no to chrome, so you would not mess it at all. I will ask about this...

Scott

EDIT: As a side note, I always go for custom install, regardless of the program...I want to see what is being installed...

JJ_Egan

Hi jj, lost me a bit there. Are you saying that Avast is more likely to show more false positives than AVG because of the way it works? Am I right in thinking that you are not as anti AVG as some others on this site. The thing is , The AV is not detecting it, Malwarebytes is.

Nope the trend is for more false positives to be picked up with any modern security suite .
AVG if it was a dog i would shoot it . My only recommendations are and have always been Nod32 or Kaspersky due to the pair of them getting multiple advanced+ in AV Comparatives tests .

jje