What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Avast! finds.........False Positive or Trojan?

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
CLOSE THIS AS RESOLVED
=========================================================================

FALSE POSITIVE


:smack: It finally happened!!! I found one on my own system.
It did happen though as I was in the process of installing an OS and etc to a new Hdd, I was almost finished with the tid bits. :pullhair:
I turned of Avast's OnAccess Protection to run an online AV scan from ESET, then made the big mistake and forgot to turn it back on. :wacko:

So I have run MBAM, Avast & ThreatFire, below is the HJT & Avast Logs.
I would like to remove the 2 programs affected by the Trojan if it is in fact not a FP.(False Positive)
If you can offer any other advice on the startups, to help my system run faster, that would be very much appreciated. :thumbup:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:52:06 PM, on 12/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Documents and Settings\Owner\Application Data\Transcend\JFSW2\JFSW2Launch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\ThreatFire\TFService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4329.1504\swg.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKCU\..\Run: [JFSW2Launch] C:\Documents and Settings\Owner\Application Data\Transcend\JFSW2\JFSW2Launch.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_674125AABFE11C21.dll/cmsidewiki.html
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1259503907390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1259504172593
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36BA0124-6DEC-4850-B07D-83C49A15DE5D}: NameServer = 192.168.0.1
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\ThreatFire\TFService.exe

–
End of file - 7088 bytes



Log from (updated) Avast scan.

12/3/2009 12:39:48 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe" file.
12/3/2009 12:40:50 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\IObit\IObit SmartDefrag\SDInit.exe" file.
12/3/2009 12:40:59 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\IObit\IObit SmartDefrag\unins000.exe" file.
12/3/2009 12:41:37 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\advcheck.dll" file.
12/3/2009 12:41:47 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\blindman.exe" file.
12/3/2009 12:41:57 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\MNNFRPYHWINEHHF.scr" file.
12/3/2009 12:42:09 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\OEBPWQPNIMIJUP.scr" file.
12/3/2009 12:42:13 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Plugins\Chai.dll" file.
12/3/2009 12:42:20 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Plugins\Fennel.dll" file.
12/3/2009 12:42:24 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Plugins\Mate.dll" file.
12/3/2009 12:42:26 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Plugins\TCPIPAddress.dll" file.
12/3/2009 12:42:40 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\SDFiles.exe" file.
12/3/2009 12:42:42 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" file.
12/3/2009 12:42:45 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\SDMain.exe" file.
12/3/2009 12:42:47 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" file.
12/3/2009 12:42:49 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" file.
12/3/2009 12:42:52 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" file.
12/3/2009 12:42:55 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Tools.dll" file.
12/3/2009 12:42:56 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\UninsSrv.dll" file.
12/3/2009 12:42:58 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Update.exe" file.
12/3/2009 12:42:59 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Updates\advcheck165.exe\{app}\advcheck.dll" file.
12/3/2009 12:43:02 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\Updates\teatimer166.exe\{app}\TeaTimer.exe" file.
12/3/2009 12:43:05 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\XZGGAOBYBWOVH.scr" file.
12/3/2009 12:43:07 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\Program Files\Spybot - Search & Destroy\YYLPOO.scr" file.
12/3/2009 12:43:24 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP18\A0004374.exe" file.
12/3/2009 12:45:07 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007410.exe" file.
12/3/2009 12:45:14 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007411.exe" file.
12/3/2009 12:45:21 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007412.exe" file.
12/3/2009 12:45:24 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007413.dll" file.
12/3/2009 12:45:27 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007414.exe" file.
12/3/2009 12:45:29 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007415.scr" file.
12/3/2009 12:45:31 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007416.scr" file.
12/3/2009 12:45:36 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007417.dll" file.
12/3/2009 12:45:37 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007418.dll" file.
12/3/2009 12:45:40 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007419.dll" file.
12/3/2009 12:45:43 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007420.dll" file.
12/3/2009 12:45:44 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007421.exe" file.
12/3/2009 12:45:45 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007422.dll" file.
12/3/2009 12:45:46 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007423.exe" file.
12/3/2009 12:45:47 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007424.exe" file.
12/3/2009 12:45:49 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007425.exe" file.
12/3/2009 12:45:50 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007426.exe" file.
12/3/2009 12:45:52 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007427.dll" file.
12/3/2009 12:45:53 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007428.dll" file.
12/3/2009 12:45:54 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007429.exe" file.
12/3/2009 12:45:55 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007430.exe\{app}\advcheck.dll" file.
12/3/2009 12:45:56 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007431.exe\{app}\TeaTimer.exe" file.
12/3/2009 12:45:58 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007432.scr" file.
12/3/2009 12:45:59 PM Owner 2204 Sign of "Win32:Delf-MZG [Trj]" has been found in "C:\System Volume Information\_restore{02CD9678-C1B7-4715-8BAB-18E472376B11}\RP33\A0007433.scr" file.


Thanks in Advance
Jkc73 :)
Post #3
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI