Got Hit by "Avanish" malware, missed by W10 security

TairikuOkami said:

It sounds like a false positive, most likely caused by VPN or other installed software, since it kept reoccuring.
The only other reason, it would be restoring, would be a scheduled task used by fileless malware - autoruns.

The
I wonder how you have concluded the" re-occurrence" you you've mentioned, if you are eluding to the number of "Avinash" in the start-up list, that's just the nature of the malware to simply cause havoc and slow the system to the crawl, soon after the discovery Hitman Pro, stopped the malware and quarantined "Avanish.exe and Anachronism.exe" remnant files which defeats the "fileless " malware. In so far whatever Hitman did seems to be holding and no more signs of the Malware which amazed me that no one ever heard of .

- - - Updated - - -

TairikuOkami said:

It sounds like a false positive, most likely caused by VPN or other installed software, since it kept reoccuring.
The only other reason, it would be restoring, would be a scheduled task used by fileless malware - autoruns.

BTW, what is a "False Positive"... perhaps a truncated statement? or is it?

Rickerz said:

BTW, what is a "False Positive"... perhaps a truncated statement? or is it?

No, that's the full statement, it's a commonly used term in the anti-virus industry. See:

How-To Geek | How To Tell If a Virus Is Actually a False Positive

It sounds like you have a malware infection. Please do this ...

---------------------------------------------------
Farbar Recovery Scan Tool (FRST)

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, and that will be the right version.

• Right-click FRST.exe/FRST64.exe then click "Run as administrator"
• When the tool opens, click Yes to the disclaimer.
• Press the Scan button.
• When finished, it will produce logs called FRST.txt and Addition.txt in the same directory the tool was run from.
• Please copy and paste the logs in your next reply.

iMacg3 said:

It sounds like you have a malware infection. Please do this ...

---------------------------------------------------
Farbar Recovery Scan Tool (FRST)

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system, download both of them and try to run them. Only one of them will run on your system, and that will be the right version.

• Right-click FRST.exe/FRST64.exe then click "Run as administrator"
• When the tool opens, click Yes to the disclaimer.
• Press the Scan button.
• When finished, it will produce logs called FRST.txt and Addition.txt in the same directory the tool was run from.
• Please copy and paste the logs in your next reply.

Yeah , i did, or shall I say my PC had! right now the intent is how to delete the traces the malware left behind namely in the start-up (please refer to screen capture showing above)... but If "Farbar Recovery Scan Tool" is capable to cleanup the startup list It would be nice.
will it?

Rickerz said:

Yeah , i did, or shall I say my PC had! right now the intent is how to delete the traces the malware left behind namely in the start-up (please refer to screen capture showing above)... but If "Farbar Recovery Scan Tool" is capable to cleanup the startup list It would be nice.
will it?

Yes.
If you are able to download and run FRST, please post the contents of FRST.txt and Addition.txt in your reply.

All that seems to have been achieved in 3 days is to be stuck at the beginning.A clean install allows you the pleasure of the middle finger salute to the virus providers.One or preferably two inexpensive drives for backup usage will give you peace of mind,using Macrium of course.
Stop fiddling around.

Bree said:

No, that's the full statement, it's a commonly used term in the anti-virus industry. See:

How-To Geek | How To Tell If a Virus Is Actually a False Positive

Hi there

@Bree

I wouldn't take that as "Gospel" in any way shape or form -- I'm sure any sensible hacker worthy of the name would do their utmost to "poodlefake" stuff so everything looks as legit as possible and I'm sure some of those "Scumbags" intent on wrecking people's machines will already be well aware of that type of literature.

Normally though malware isn't such a mega problem these days since scammers are all in it to make money and this can easily be done (apparently !!!) by methods that really don't involve using malware or viruses any more --the only places you might get that stuff from is by using some of the more dubious torrent and warez sites -- most popular torrent sites these days don't want their users getting infected either. I think even that old site still flying the jolly roger blocks people who upload torrents with malware in them.

Fake websites , opening emails from unknown senders, replying to unsolicited questionaires, replying to websites offering you "Tax Refunds" which look official and above all giving out too much data on these social media sites is where these people operate at now. The effort of creating viruses to load on "mom and pop" machines won't yield much money - especially for the effort involved -- but catching them with a nice easy scam which gets things like their credit card details is a much more profitable enterprise.

Keep your machine(s) regularly backed up -- Macrium Free -- just run it from within windows --save your image to an external device and if you need to restore simply boot from the recovery tool and restore from the image you made --couldn't be simpler -- it's all easily menu driven.

@joeandmarg0

agree 100% rep given (double if I could -- why people don't take regular backups is totally beyond me - we've all hosed up machines I'm sure at some time in the past - and restoring is so easy). I think the original user after 3 days is in a worse state than when starting -- We'd call it "Back to square MINUS Z" -- i.e worse than back to square A or one). Even on a slowish machine a macrium restore shouldn't take more than around 30 mins for average Windows systems.

Cheers
jimbo

A factory reset is certainly an option. However, we can try to clean the malware without formatting/reinstalling Windows.

If you decide to do so, please post the logs from FRST. If you decide to go with a factory reset, let us know and we can help you with the steps involved in doing so.

simrick said:

Hi.
Did you miss my post #5?
Got Hit by "Avanish" malware, missed by W10 security
.

No I did not miss your comment, first of I already dealt with the malware, second installing Kerpesky is not advised by the DOD in my machine. Sorry for the late response tho.