A customer brought in a laptop that was infested with quite a few PUPs, torjans, viruses, adware and just about everything else.
I have removed all the PUPs using a combination of adwcleaner, JRT, Malwarebytes and Avast and Trend Micro's House Call. Anything left over was removed using Revo uninstaller.
I then perfromed the Windows 8.1 update.
At this point I wanted to run the AVG rescue disk, but this laptop doesn't have an optical drive. I have a copy on a USB flash drive, but even though I get the UEFI to allow booting from a USB device, it keeps refusing to boot from the flash drive. At this point I'm not sure if it's the drive or the computer causing this.
The problem is that, even though the computer works perfectly, Avast keeps reporting that it has blocked malware. It seems to be outgoing attempts to contact assorted websites, and I'm really not sure if these are false positives or a legitimate function.
For example: (don't click these links)
hxxp://bestdriverstar.net/4242/segmentsustainer_142667093542149.dll (Process svchost.exe)
hxxp://anythicago.com/4242/seekerinstance_142666919466027.dll (missed the process on this one)
hxxp://simplesitescan.net/4242/softwareForce_142669433532350.dll (Process c:\windows\system32\svchost.exe
They all follow the same pattern of Avast going "ding-ding-ding" Threat has been detected, and then a window will pop up showing it blocked an attempt at outside communication (URL:Mal).
I have done the full Avast scan that reboots the computer and scans everything, and it did find some infected files, which were quarrantined or removed. I'm still getting this problem though.
In Programs and Features, I have looked through the entire list and all the remaining programs are from Microsoft, ASUS, Adobe, Alcor Micro Corp (USB card reader), Atheros (netwrok driver, bluetooth driver, client installation program), IvoSoft (Classic Shell), or Intel. Nothing unusual that I can find.
Can someone tell me if I'm chasing a flase positive or if there is still an infection? The Avast website seems to think there is still an infection causing these warnings.
I just discovered that the laptop is toasting my AVG rescue USB flash drive. I reformatted it and used diskpart to get it bootable again, put the AVG rescue files back on the drive and tested it on a Dell desktop, and it worked perfectly. When I put it into this laptop, and set UEFI to allow it to boot, one of two things happens: Either the option to allow this USB device to boot is just gone, or it will just not boot from the USB flash drive. This time when I tried it, I retested the USB flash drive in another PC and it is now corrupted. I think the virus is corrupting the flash drive.
Edited by Mok, 03 June 2015 - 04:24 PM.
Deactivated links. ~ OB