What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Rootkit.Agent and Backdoor.ProRat

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
When I connect to the Internet things slow down until my computer becomes unresponsive. There is drive activity but I can get things to function well.

My AVG Anti-Virus has detected Rootkit.Agent.H, Backdoor. ProRat and Trojan.Hiloti and others. I had removed them but they reappeared. After scanning with MalwareBytes they appears to be gone. There are a few unknown items in the startup programs listed in the System Configuration Utility.

Cannot seem to remove these items - 3pipe-USApdA, Cfahaqoxoqir, oneqaquzuw, ifoqm

In folder options I have selected the Show hidden files and folders option and run HijackThis.

Log files for HijackThis and MalwareBytes are as follows:


Malwarebytes' Anti-Malware 1.33
Database version: 1747
Windows 5.1.2600

2009-02-10 21:45:32
mbam-log-2009-02-10 (21-45-32).txt

Scan type: Quick Scan
Objects scanned: 45114
Time elapsed: 5 minute(s), 4 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 8
Registry Values Infected: 6
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 21

Memory Processes Infected:
C:\WINDOWS\services.exe (Backdoor.ProRat) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aec (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\aec (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aec (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\surrd (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sbfxi (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\surrd (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\surrd (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\services (Backdoor.ProRat) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\services (Backdoor.ProRat) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services (Backdoor.ProRat) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\services (Backdoor.ProRat) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Microsoft Common (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\System32\drivers\mrxdavv.sys (Rootkit.Agent.H) -> Delete on reboot.
C:\WINDOWS\services.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\DRIVERS\aec.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\TEMP\rdl9.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl1.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl3.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl4.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl5.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl6.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl7.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Virginia Sutherland\Local Settings\temp\rdl8.tmp (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Microsoft Common\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\sbfxi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\kwave.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\surrd.sys (Rootkit.Agent) -> Quarantined and deleted successfully.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:06, on 2009-02-11
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\EARTHL~1\PROTEC~1\ADSSER~1.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\ifoq\ifoqm.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe
C:\Program Files\CallWave\IAM.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\PROGRA~1\COMMON~1\ifoq\ifoqa.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\ifoq\ifoql.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\elnIE.dll
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe,C:\Documents and Settings\Virginia Sutherland\ixn.exe \s,
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [Qxukiha] rundll32.exe "C:\WINDOWS\Cfahaqoxoqir.dll",e
O4 - HKLM\..\Run: [Earthlink Protection Control Center] C:\Program Files\EarthLink TotalAccess\\ProtectionControlCenter\elnk_pcc.exe /minimize /debug
O4 - HKLM\..\Run: [Ahicupovilome] rundll32.exe "C:\WINDOWS\oneqaquzuw.dll",e
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ifoq] C:\PROGRA~1\COMMON~1\ifoq\ifoqm.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [SfKg6wIP] C:\Documents and Settings\Virginia Sutherland\Application Data\Microsoft\Windows\drbmv.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [reader_s] C:\Documents and Settings\Virginia Sutherland\reader_s.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [SfKg6wIP] C:\Documents and Settings\Virginia Sutherland\Application Data\Microsoft\Windows\drbmv.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Instant Update Reminder.lnk = ?
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: Win32 Classes -
O20 - Winlogon Notify: netprp - netprp.dll (file missing)
O20 - Winlogon Notify: syncps - syncps.dll (file missing)
O23 - Service: ADSService - Aluria Software, LLC - C:\PROGRA~1\EARTHL~1\PROTEC~1\ADSSER~1.EXE
O23 - Service: Windows Audio AudioSrvEarthLinkMonitor (AudioSrvEarthLinkMonitor) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Windows Audio AudioSrvEarthLinkMonitor AudioSrvEarthLinkMonitorseclogon (AudioSrvEarthLinkMonitorseclogon) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Computer Browser BrowserNetman (BrowserNetman) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Indexing Service cisvcWmiAudioSrv (cisvcWmiAudioSrv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: dvpapi dvpapiRasAuto (dvpapiRasAuto) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Unknown owner - C:\PROGRA~1\EARTHL~1\PROTEC~1\EFWPPS~1.EXE
O23 - Service: EarthLink Protection Control Center Service (ELNKService) - Unknown owner - C:\Program Files\EarthLink TotalAccess\\ProtectionControlCenter\ELNKServ.exe
O23 - Service: EarthLink Protection Control Center Service ELNKServiceTrkWks (ELNKServiceTrkWks) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: EarthLink Protection Control Center Service ELNKServiceupnphost (ELNKServiceupnphost) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: EarthLink Protection Control Center Service ELNKServiceupnphost ELNKServiceupnphostsrservice (ELNKServiceupnphostsrservice) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: EarthLink Protection Control Center Service ELNKServicewuauserv (ELNKServicewuauserv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Error Reporting Service ERSvcNtLmSspW32TimeBITS (ERSvcNtLmSspW32TimeBITS) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Fast User Switching Compatibility FastUserSwitchingCompatibilityClipSrv (FastUserSwitchingCompatibilityClipSrv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Help and Support helpsvclanmanworkstation (helpsvclanmanworkstation) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Help and Support helpsvcNetlogon (helpsvcNetlogon) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Workstation lanmanworkstationNtmsSvc (lanmanworkstationNtmsSvc) - Unknown owner - C:\WINDOWS\system32\B7.tmp.exe (file missing)
O23 - Service: NetMeeting Remote Desktop Sharing mnmsrvcSCardSvr (mnmsrvcSCardSvr) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Network DDE NetDDElanmanworkstationNtmsSvc (NetDDElanmanworkstationNtmsSvc) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Network Connections Netmandmserver (Netmandmserver) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: NT LM Security Support Provider NtLmSspW32Time (NtLmSspW32Time) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: NT LM Security Support Provider NtLmSspW32Time NtLmSspW32TimeBITS (NtLmSspW32TimeBITS) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Plug and Play PlugPlaylanmanserver (PlugPlaylanmanserver) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: IPSEC Services PolicyAgentBrowser (PolicyAgentBrowser) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Protected Storage ProtectedStorageTrkWks (ProtectedStorageTrkWks) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Routing and Remote Access RemoteAccessPlugPlay (RemoteAccessPlugPlay) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Remote Procedure Call (RPC) Locator RpcLocatorRDSessMgr (RpcLocatorRDSessMgr) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Remote Procedure Call (RPC) RpcSslanmanworkstation (RpcSslanmanworkstation) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: System Managment Controler SMSCGISVCPlugPlay (SMSCGISVCPlugPlay) - Unknown owner - C:\WINDOWS\System32\MSJAVAz.exe
O23 - Service: SSDP Discovery Service SSDPSRVVSS (SSDPSRVVSS) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Windows Image Acquisition (WIA) stisvcdmserver (stisvcdmserver) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: MS Software Shadow Copy Provider SwPrvhelpsvc (SwPrvhelpsvc) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: MS Software Shadow Copy Provider SwPrvTapiSrv (SwPrvTapiSrv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Telephony TapiSrvTapiSrv (TapiSrvTapiSrv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Terminal Services TermServiceNtLmSsp (TermServiceNtLmSsp) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Distributed Link Tracking Client TrkWksW32TimeRasMan (TrkWksW32TimeRasMan) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Uninterruptible Power Supply UPScisvc (UPScisvc) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Windows Time W32TimeRasMan (W32TimeRasMan) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: WebClient WebClientClipSrv (WebClientClipSrv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Windows Management Instrumentation Driver Extensions WmiAudioSrv (WmiAudioSrv) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Windows Management Instrumentation Driver Extensions WmiSSDPSRVVSS (WmiSSDPSRVVSS) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Windows Management Instrumentation Driver Extensions WmiSSDPSRVVSS WmiSSDPSRVVSSSMSCGISVCPlugPlay (WmiSSDPSRVVSSSMSCGISVCPlugPlay) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Automatic Updates wuauservRDSessMgr (wuauservRDSessMgr) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe
O23 - Service: Automatic Updates wuauservRDSessMgr wuauservRDSessMgrTermService (wuauservRDSessMgrTermService) - Unknown owner - C:\WINDOWS\System32\VDODEC32y.exe

–
End of file - 10168 bytes
Post #2
Hello and welcome to Posted Image

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your HJT log now, I will post back shortly with instructions.
Post #3
Hi brianleo

I have some bad news for you.

Unfortunately your system is very seriously infected. If this is in fact virut then in all likelihood all your files are infected and the only way out is a complete reformat.

Save any pictures/music or documents you may have on external media (do not save any exe files ) in the event this machine cannot be cleaned.

There are tools available which I can try that claim to rid this infection, but if it has gone too far - a total reformat will be your only option.

If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps


This infection may have something to do with your operating system being way out of date. Why have you not upgraded?

We cannot begin to clean your system until you have updated to at least SP1a , or as fast as we clean - you will just get re-infected again.

  • I can try and clean this machine but it it very important you follow the instructions IN THE ORDER THEY ARE GIVEN.

FIRST

DOWNLOAD AND INSTALL SERVICE PACK 1a from Microsoft HERE


SECOND

* Open HiJackThis
* Click on Do a system scan only
* Check the boxes next to ONLY the entries listed below (if present):

O4 - HKLM\..\Run: [reader_s] C:\WINDOWS\System32\reader_s.exe
O4 - HKLM\..\Run: [Qxukiha] rundll32.exe "C:\WINDOWS\Cfahaqoxoqir.dll",e
O4 - HKLM\..\Run: [Ahicupovilome] rundll32.exe "C:\WINDOWS\oneqaquzuw.dll",e
O4 - HKCU\..\Run: [ifoq] C:\PROGRA~1\COMMON~1\ifoq\ifoqm.exe
O4 - HKUS\S-1-5-18\..\Run: [SfKg6wIP] C:\Documents and Settings\Virginia Sutherland\Application Data\Microsoft\Windows\drbmv.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [reader_s] C:\Documents and Settings\Virginia Sutherland\reader_s.exe (User 'SYSTEM')
O20 - Winlogon Notify: netprp - netprp.dll (file missing)
O20 - Winlogon Notify: syncps - syncps.dll (file missing)

* Close all windows except Hijackthis and click Fix Checked
* Click Yes when prompted
* Close HijackThis.



THIRD

Download Dr.Web CureIt to the desktop:
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.


FOURTH


Download avz4.zip from here[1]Unzip it to your desktop to a folder named avz4
[2]Double click on AVZ.exe to run it.
[3]Run an update by clicking the Auto Update button on the Right of the Log window:
[4]ClickStart to begin the update
Note: If you receive an error message, chose a different source, then click Start again [1]Start AVZ.
[2]Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation"check box.
[3]Click on the “Execute selected scripts”.
[4]Automatic scanning, healing and system check will be executed.
[5]A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
[6]It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
[7]All applications will work properly after the system restart.

When restarted
[1]Start AVZ.
[2]Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
[3]Click on the "Execute selected scripts".
[4]A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZdirectory as virusinfo_syscheck.zip.
Attach both zip files to your next post

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image]to insert the attachment into your post


In your next reply include


  • DrWeb log (note it may have to be renamed to .txt to upload here)
  • AVZ logs
  • Fresh HJT Log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI