Windows 7: Trojans Necurs.A.44 and Crypt.ULPM.Gen detected by Avira

Hi.



Here it is:

info: --------------------------------------------------------------------------------
info: ESET Necurs Remover v2.0.0.0 (Nov 26 2012 14:10:55)
info: --------------------------------------------------------------------------------
info: OS: 6.1.7601 SP1
info: Product type: workstation
info: WoW64: 1
info: --------------------------------------------------------------------------------
debug: debug mode self-test
info: Could not detect rootkit 01.
info: Rootkit has not been found.

What is Avira detecting now, if anything?

After that first day, it detected anything anymore. Should I do a full scan to be sure?

Good idea!

Post back the results.

I did a full scan in admin mode, and again, the mIRC client CyberScript was detected (I'm already used to it). Other than that, it looks like my laptop is clean, according to Avira.
Below is an English translation of the log. I've attached the original one.


English translation:


Avira Free Antivirus
File Report date: Monday, February 18th 2013 12:02

Scanning as of 5025979 suspected virus and unwanted programs.

Program is running on full version without limitations.
Online services are available.

Licensed : Avira Free Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows 7 Home Premium
Windows version : (Service Pack 1) [6.1.7601]
Boot mode : Normal
User name : Camila
Computer name : TARDIS

Version information:
BUILD.DAT : 12.1.9.342 40870 Bytes 18/10/2012 08:19:00
AVSCAN.EXE : 12.3.0.48 468256 Bytes 15/11/2012 02:50:26
AVSCAN.DLL : 12.3.0.15 62416 Bytes 14/08/2012 17:36:19
LUKE.DLL : 12.3.0.15 68304 Bytes 14/08/2012 17:36:19
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 09/05/2012 02:10:39
AVREG.DLL : 12.3.0.17 232200 Bytes 11/05/2012 02:10:51
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 22:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 03:31:02
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20/12/2011 18:29:04
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01/02/2012 02:10:29
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28/03/2012 02:10:40
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29/06/2012 02:11:42
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06/09/2012 22:29:19
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22/11/2012 21:52:58
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07/02/2013 01:29:18
VBASE009.VDF : 7.11.60.11 2048 Bytes 07/02/2013 01:29:18
VBASE010.VDF : 7.11.60.12 2048 Bytes 07/02/2013 01:29:18
VBASE011.VDF : 7.11.60.13 2048 Bytes 07/02/2013 01:29:18
VBASE012.VDF : 7.11.60.14 2048 Bytes 07/02/2013 01:29:18
VBASE013.VDF : 7.11.60.62 351232 Bytes 08/02/2013 01:27:15
VBASE014.VDF : 7.11.60.115 190976 Bytes 09/02/2013 01:27:16
VBASE015.VDF : 7.11.60.177 282624 Bytes 11/02/2013 21:20:14
VBASE016.VDF : 7.11.60.249 215552 Bytes 13/02/2013 21:20:14
VBASE017.VDF : 7.11.61.65 151040 Bytes 15/02/2013 21:20:18
VBASE018.VDF : 7.11.61.135 159232 Bytes 18/02/2013 14:56:35
VBASE019.VDF : 7.11.61.136 2048 Bytes 18/02/2013 14:56:35
VBASE020.VDF : 7.11.61.137 2048 Bytes 18/02/2013 14:56:36
VBASE021.VDF : 7.11.61.138 2048 Bytes 18/02/2013 14:56:36
VBASE022.VDF : 7.11.61.139 2048 Bytes 18/02/2013 14:56:36
VBASE023.VDF : 7.11.61.140 2048 Bytes 18/02/2013 14:56:36
VBASE024.VDF : 7.11.61.141 2048 Bytes 18/02/2013 14:56:37
VBASE025.VDF : 7.11.61.142 2048 Bytes 18/02/2013 14:56:37
VBASE026.VDF : 7.11.61.143 2048 Bytes 18/02/2013 14:56:37
VBASE027.VDF : 7.11.61.144 2048 Bytes 18/02/2013 14:56:37
VBASE028.VDF : 7.11.61.145 2048 Bytes 18/02/2013 14:56:38
VBASE029.VDF : 7.11.61.146 2048 Bytes 18/02/2013 14:56:38
VBASE030.VDF : 7.11.61.147 2048 Bytes 18/02/2013 14:56:38
VBASE031.VDF : 7.11.61.154 103936 Bytes 18/02/2013 14:56:39
Mechanism version : 8.2.12.2
AEVDF.DLL : 8.1.2.10 102772 Bytes 11/07/2012 02:11:47
AESCRIPT.DLL : 8.1.4.92 471418 Bytes 15/02/2013 21:20:34
AESCN.DLL : 8.1.10.0 131445 Bytes 13/12/2012 23:40:00
AESBX.DLL : 8.2.5.12 606578 Bytes 15/06/2012 02:11:31
AERDL.DLL : 8.2.0.88 643444 Bytes 11/01/2013 01:27:14
AEPACK.DLL : 8.3.1.2 819574 Bytes 20/12/2012 23:40:13
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 06/11/2012 00:54:21
AEHEUR.DLL : 8.1.4.206 5747064 Bytes 15/02/2013 21:20:33
AEHELP.DLL : 8.1.25.2 258423 Bytes 12/10/2012 01:16:05
AEGEN.DLL : 8.1.6.16 434549 Bytes 25/01/2013 01:27:11
AEEXP.DLL : 8.4.0.0 188788 Bytes 15/02/2013 21:20:35
AEEMU.DLL : 8.1.3.2 393587 Bytes 11/07/2012 02:11:42
AECORE.DLL : 8.1.31.0 201079 Bytes 15/02/2013 21:20:23
AEBB.DLL : 8.1.1.4 53619 Bytes 06/11/2012 00:54:04
AVWINLL.DLL : 12.3.0.15 27344 Bytes 14/08/2012 17:36:19
AVPREF.DLL : 12.3.0.32 50720 Bytes 15/11/2012 02:50:24
AVREP.DLL : 12.3.0.15 179208 Bytes 09/05/2012 02:10:38
AVARKT.DLL : 12.3.0.33 209696 Bytes 15/11/2012 02:50:23
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 14/08/2012 17:36:19
SQLITE3.DLL : 3.7.0.1 398288 Bytes 14/08/2012 17:36:19
AVSMTP.DLL : 12.3.0.32 63480 Bytes 14/08/2012 17:36:19
NETNT.DLL : 12.3.0.15 17104 Bytes 14/08/2012 17:36:19
RCIMAGE.DLL : 12.1.0.13 4449488 Bytes 21/01/2012 03:31:22
RCTEXT.DLL : 12.3.0.32 99104 Bytes 15/11/2012 02:50:19

Scanning configuration options:
Task name...........................................: Complete system scan
Configuration file..................................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Registry............................................: standard
Primary action......................................: Interactive
Secondary action....................................: Ignore
Scan master boot sector.............................: enabled
Scan boot sector....................................: enabled
Boot sectors........................................: C:, D:,
Scan process........................................: enabled
Scan extended process...............................: enabled
Scan registry.............................................: enabled
Scan rootkits.......................................: enabled
Scan system files integrity.........................: off
Scan all files......................................: All files
Scan archives.......................................: enabled
Recursion depth.....................................: 20
Smart extensions....................................: enabled
Macro heuristics....................................: enabled
Files heuristics....................................: extended

Scan start: Monday, February 18th 2013, 12:02

Starting scan of master boot sector:
Master boot sector HD0
[INFO] No virus was found!

Start scan of boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting search for hidden objects.

Scan of process in execution will start
Scan process 'avscan.exe' – was scanned in '83' module(s)
Scan process 'javaw.exe' – was scanned in '85' module(s)
Scan process 'Opera.exe' – was scanned in '109' module(s)
Scan process 'UNS.exe' – was scanned in '59' module(s)
Scan process 'IAStorDataMgrSvc.exe' – was scanned in '51' module(s)
Scan process 'BluetoothHeadsetProxy.exe' – was scanned in '22' module(s)
Scan process 'CyberScript.exe' – was scanned in '58' module(s)
Scan process 'iTunesHelper.exe' – was scanned in '73' module(s)
Scan process 'avgnt.exe' – was scanned in '84' module(s)
Scan process 'IAStorIcon.exe' – was scanned in '52' module(s)
Scan process 'Skype.exe' – was scanned in '152' module(s)
Scan process 'GoogleUpdate.exe' – was scanned in '51' module(s)
Scan process 'uTorrent.exe' – was scanned in '83' module(s)
Scan process 'flux.exe' – was scanned in '56' module(s)
Scan process 'speedfan.exe' – was scanned in '68' module(s)
Scan process 'mbamgui.exe' – was scanned in '37' module(s)
Scan process 'TeamViewer_Service.exe' – was scanned in '80' module(s)
Scan process 'mbamservice.exe' – was scanned in '44' module(s)
Scan process 'mbamscheduler.exe' – was scanned in '35' module(s)
Scan process 'LMS.exe' – was scanned in '32' module(s)
Scan process 'cronsvc.exe' – was scanned in '33' module (s)
Scan process 'AppleMobileDeviceService.exe' – was scanned in '65' module(s)
Scan process 'avguard.exe' – was scanned in '63' module(s)
Scan process 'sched.exe' – was scanned in '44' module(s)

Starting scan of executables files (registry).
Registry can complete ('4093' files).


Starting file scan:

Start scan in 'C:\' <Alpha 5>
C:\Windows\SoftwareDistribution\Download\822a5f69967ea43ae6e33473c9a5200b\Windows6.1-KB958488-x64.cab
[0] Archive type: CAB (Microsoft)
--> amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7600.16513_none_b9011a1a337e72a1\netfxperf.dll
[WARNING] Could not write file!
Start scan in 'D:\' <Alpha 6>
D:\Documentos\Instaladores\CyberScript32.exe
[0] Archive type: Inno Setup
--> {app}\msnmirc\dll\ssl.dll
[DETECTION] Trojan horse TR/Agent.prt.9

Starting disinfection:
D:\Documentos\Instaladores\CyberScript32.exe
[DETECTION] Trojan horse TR/Agent.prt.9
[WARNING] File was ignored!


End of scan: Monday, February 18th 2013, 14:10
Scan time: 2:06:39 Hour(s)

Scan was completed.

33280 scanned directories
1062246 Files scanned
1 Virus and/or unwanted programs were found
0 Files were classified as suspects
0 Deleted files
0 Repaired virus and unwanted programs
0 Files moved to quarantine
0 Renamed files
0 Files could not be scanned
1062245 Not involved files
8431 Scanned archives
2 Warnings
0 Notes
780484 Objects scanned with rootkit scan
0 Hidden objects found

D:\Documentos\Instaladores\CyberScript32.exe
[0] Archive type: Inno Setup
--> {app}\msnmirc\dll\ssl.dll
[DETECTION] Trojan horse TR/Agent.prt.9

Starting disinfection:
D:\Documentos\Instaladores\CyberScript32.exe
[DETECTION] Trojan horse TR/Agent.prt.9
[WARNING] File was ignored!


Does Avira give you the option to quarantine this file?

Yeah, it does. I was the one that commanded Avira to ignore it. That specific file is just the installer that I kept (instaladores = installers). I can delete it, though.

If you can do without that file, please let AVIRA delete it. A virus is reported associated with it.

Then, after you are done, please run another Full Scan with Avira, and post what it shows.

Hopefully we will kill two birds with one stone. You will get rid of the message you have been getting, and the infected file will be gone.


Have a hunch you are in Brazil, since the reports appear to be in Portuguese.
Can understand Spanish (parents came from Spain), so, if I 'stretch it' can read most of them.

I have deleted the file myself (with shift delete), since Avira was stucking at 30% when trying to delete it or quarantine it. I did a full scan after that and nothing was found:

Avira Free Antivirus
File report date: Monday, February 18th 2013 21:22

Scanning as of 5029407 suspected virus and unwanted programs.

Program is running as full version without limitations
Online services are available.

Licensed : Avira Free Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows 7 Home Premium
Windows version : (Service Pack 1) [6.1.7601]
Boot mode : Normal
User name : Camila
Computer name : TARDIS

Version information:
BUILD.DAT : 12.1.9.342 40870 Bytes 18/10/2012 08:19:00
AVSCAN.EXE : 12.3.0.48 468256 Bytes 15/11/2012 02:50:26
AVSCAN.DLL : 12.3.0.15 62416 Bytes 14/08/2012 17:36:19
LUKE.DLL : 12.3.0.15 68304 Bytes 14/08/2012 17:36:19
AVSCPLR.DLL : 12.3.0.14 97032 Bytes 09/05/2012 02:10:39
AVREG.DLL : 12.3.0.17 232200 Bytes 11/05/2012 02:10:51
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06/11/2009 22:18:34
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 03:31:02
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20/12/2011 18:29:04
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01/02/2012 02:10:29
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28/03/2012 02:10:40
VBASE005.VDF : 7.11.34.116 4034048 Bytes 29/06/2012 02:11:42
VBASE006.VDF : 7.11.41.250 4902400 Bytes 06/09/2012 22:29:19
VBASE007.VDF : 7.11.50.230 3904512 Bytes 22/11/2012 21:52:58
VBASE008.VDF : 7.11.60.10 6627328 Bytes 07/02/2013 01:29:18
VBASE009.VDF : 7.11.60.11 2048 Bytes 07/02/2013 01:29:18
VBASE010.VDF : 7.11.60.12 2048 Bytes 07/02/2013 01:29:18
VBASE011.VDF : 7.11.60.13 2048 Bytes 07/02/2013 01:29:18
VBASE012.VDF : 7.11.60.14 2048 Bytes 07/02/2013 01:29:18
VBASE013.VDF : 7.11.60.62 351232 Bytes 08/02/2013 01:27:15
VBASE014.VDF : 7.11.60.115 190976 Bytes 09/02/2013 01:27:16
VBASE015.VDF : 7.11.60.177 282624 Bytes 11/02/2013 21:20:14
VBASE016.VDF : 7.11.60.249 215552 Bytes 13/02/2013 21:20:14
VBASE017.VDF : 7.11.61.65 151040 Bytes 15/02/2013 21:20:18
VBASE018.VDF : 7.11.61.135 159232 Bytes 18/02/2013 14:56:35
VBASE019.VDF : 7.11.61.163 152064 Bytes 18/02/2013 22:20:33
VBASE020.VDF : 7.11.61.164 2048 Bytes 18/02/2013 22:20:34
VBASE021.VDF : 7.11.61.165 2048 Bytes 18/02/2013 22:20:34
VBASE022.VDF : 7.11.61.166 2048 Bytes 18/02/2013 22:20:35
VBASE023.VDF : 7.11.61.167 2048 Bytes 18/02/2013 22:20:36
VBASE024.VDF : 7.11.61.168 2048 Bytes 18/02/2013 22:20:37
VBASE025.VDF : 7.11.61.169 2048 Bytes 18/02/2013 22:20:38
VBASE026.VDF : 7.11.61.170 2048 Bytes 18/02/2013 22:20:39
VBASE027.VDF : 7.11.61.171 2048 Bytes 18/02/2013 22:20:40
VBASE028.VDF : 7.11.61.172 2048 Bytes 18/02/2013 22:20:41
VBASE029.VDF : 7.11.61.173 2048 Bytes 18/02/2013 22:20:42
VBASE030.VDF : 7.11.61.174 2048 Bytes 18/02/2013 22:20:43
VBASE031.VDF : 7.11.61.176 2048 Bytes 18/02/2013 22:20:43
Mechanism version : 8.2.12.2
AEVDF.DLL : 8.1.2.10 102772 Bytes 11/07/2012 02:11:47
AESCRIPT.DLL : 8.1.4.92 471418 Bytes 15/02/2013 21:20:34
AESCN.DLL : 8.1.10.0 131445 Bytes 13/12/2012 23:40:00
AESBX.DLL : 8.2.5.12 606578 Bytes 15/06/2012 02:11:31
AERDL.DLL : 8.2.0.88 643444 Bytes 11/01/2013 01:27:14
AEPACK.DLL : 8.3.1.2 819574 Bytes 20/12/2012 23:40:13
AEOFFICE.DLL : 8.1.2.50 201084 Bytes 06/11/2012 00:54:21
AEHEUR.DLL : 8.1.4.206 5747064 Bytes 15/02/2013 21:20:33
AEHELP.DLL : 8.1.25.2 258423 Bytes 12/10/2012 01:16:05
AEGEN.DLL : 8.1.6.16 434549 Bytes 25/01/2013 01:27:11
AEEXP.DLL : 8.4.0.0 188788 Bytes 15/02/2013 21:20:35
AEEMU.DLL : 8.1.3.2 393587 Bytes 11/07/2012 02:11:42
AECORE.DLL : 8.1.31.0 201079 Bytes 15/02/2013 21:20:23
AEBB.DLL : 8.1.1.4 53619 Bytes 06/11/2012 00:54:04
AVWINLL.DLL : 12.3.0.15 27344 Bytes 14/08/2012 17:36:19
AVPREF.DLL : 12.3.0.32 50720 Bytes 15/11/2012 02:50:24
AVREP.DLL : 12.3.0.15 179208 Bytes 09/05/2012 02:10:38
AVARKT.DLL : 12.3.0.33 209696 Bytes 15/11/2012 02:50:23
AVEVTLOG.DLL : 12.3.0.15 169168 Bytes 14/08/2012 17:36:19
SQLITE3.DLL : 3.7.0.1 398288 Bytes 14/08/2012 17:36:19
AVSMTP.DLL : 12.3.0.32 63480 Bytes 14/08/2012 17:36:19
NETNT.DLL : 12.3.0.15 17104 Bytes 14/08/2012 17:36:19
RCIMAGE.DLL : 12.1.0.13 4449488 Bytes 21/01/2012 03:31:22
RCTEXT.DLL : 12.3.0.32 99104 Bytes 15/11/2012 02:50:19

Scanning configuration options:
Task name...........................................: Complete system scan
Configuration file..................................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Registry............................................: standard
Primary action......................................: Interactive
Secondary action....................................: Ignore
Scan master boot sector.............................: enabled
Scan boot sector....................................: enabled
Boot sectors........................................: C:, D:,
Scan process........................................: enabled
Scan extended process...............................: enabled
Scan registry.............................................: enabled
Scan rootkits.......................................: enabled
Scan system files integrity.........................: off
Scan all files......................................: All files
Scan archives.......................................: enabled
Recursion depth.....................................: 20
Smart extensions....................................: enabled
Macro heuristics....................................: enabled
Files heuristics....................................: extended

Scan start: Monday, February 18th 2013, 21:22

Starting scan of master boot sector:
Master boot sector HD0
[INFO] No virus was found!

Start scan of boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting search for hidden objects.

Scan of process in execution will start
Scan process 'avscan.exe' – was scanned in '83' module(s)
Scan process 'javaw.exe' – was scanned in '85' module(s)
Scan process 'Opera.exe' – was scanned in '169' module(s)
Scan process 'UNS.exe' – was scanned in '59' module(s)
Scan process 'IAStorDataMgrSvc.exe' – was scanned in '51' module(s)
Scan process 'BluetoothHeadsetProxy.exe' – was scanned in '22' module(s)
Scan process 'iTunesHelper.exe' – was scanned in '73' module(s)
Scan process 'avgnt.exe' – was scanned in '84' module(s)
Scan process 'IAStorIcon.exe' – was scanned in '52' module(s)
Scan process 'Skype.exe' – was scanned in '152' module(s)
Scan process 'flux.exe' – was scanned in '56' module(s)
Scan process 'speedfan.exe' – was scanned in '68' module(s)
Scan process 'mbamgui.exe' – was scanned in '37' module(s)
Scan process 'TeamViewer_Service.exe' – was scanned in '80' module(s)
Scan process 'mbamservice.exe' – was scanned in '47' module(s)
Scan process 'mbamscheduler.exe' – was scanned in '35' module(s)
Scan process 'LMS.exe' – was scanned in '32' module(s)
Scan process 'cronsvc.exe' – was scanned in '33' module(s)
Scan process 'AppleMobileDeviceService.exe' – was scanned in '66' module(s)
Scan process 'avguard.exe' – was scanned in '63' module(s)
Scan process 'sched.exe' – was scanned in '44' module(s)


Starting scan of executables files (registry).
Registry can complete ('4093' files).


Starting archive scan:

Start scan in 'C:\' <Alpha 5>
C:\Windows\SoftwareDistribution\Download\822a5f69967ea43ae6e33473c9a5200b\Windows6.1-KB958488-x64.cab
[0] Archive type: CAB (Microsoft)
--> amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7600.16513_none_b9011a1a337e72a1\netfxperf.dll
[WARNING] Could not write file!
Start scan in 'D:\' <Alpha 6>


End of scan: Monday, February 18th 2013 23:32
Duration: 2:10:13 Hour(s)

Scan was completed.

33309 Scanned directories
1059938 Files were scanned
0 Virus and/or unwanted programs were found
0 Files were classified as suspects
0 Deleted files
0 Virus and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files could not be scanned
1059938 Files not involved
8347 Scanned archives
1 Warnings
0 Notes
780531 Scanned objects with rootkit scan
0 Hidden objects found

The Facemoods error message is no longer annoying me, yet it resists to remain installed.
You're right, I'm in Brazil

Good job!!

You may want to go to the FaceMoods website, and ask for assistance there.

I do not know a thing about the program, and would be the wrong person to offer guidance on it.

How is it going otherwise?
Any more malware problems?