Trojans in Updates???

[Willowhoop]

Hi guys,
Today I downloaded my important updates and a couple of suggested ones.
Since rebooting the PC to activate them, I have had Avast (paid version) sending quite a few of the updates into quarantine, stating that they have trojans attached. Below is the only info I can find for you. Let me know how to access other info you may need please.

Thanks & cheers
Willow

 

[NYKO]

Man your pc looks infected sugest you all soo scan with online bitdefender or another program to be sure it's clean, try all soo the iobit 360, it's a free soofter.

 

[Golden]

Hi Willow,

Where did you get these updates from? Are these Windows updates? If so, they are unlikely to contain trojans.

You might want to also scan your system more thoroughly now with the following:

Free ESET Online Antivirus Scanner

Also download, install and run Malwarebytes

Let us know where you got these updates from ASAP.

Regards,
Golden

 

[Willowhoop]

I got notification from window update itself guys, went to the microsoft site from the update link to see what was being recommended and what was on the optional list. Is this a false site???? OMG you have me really scared now.

Here's the image of where I got the notification from :

 

[Golden]

No, no need to panic. Its all good.

Just to give you some comfort, if you click on the two important updates, a list will come up : take screen capture of that list and post it here. Does it look similar to this one?

 

[Golden]

I have a strong suspicion this is a false positive, but I've just trawled the AVAST forums and cant find an issue related to the Windows updates. We really need an experienced AVAST user to help out here, to see if they have experienced similar issues, and if they know how to fix it.

In the meantime please do the following in this order:

1. Scan your PC using that ESET link I posted earlier.
2. If the ESET scan comes up clean, then ensure that AVAST and its database are up to date.
3. Try to download the Windows updates again.

Post back with the results.

Regards,
Golden

*** EDIT : in the AVAST blocking window is the process quoted called CSC.EXE, as shown in this image below.

*** EDIT2 : The AVAST forums have a lot of messages about suspected false positives several times a day related to strangely named .dll's. It appears that the culprit may be this CSC.EXE process. See here http://forum.avast.com/index.php?topic=69690.0

Lets see what other forum members can add.

 

[Willowhoop]

No, no need to panic. Its all good.

Just to give you some comfort, if you click on the two important updates, a list will come up : take screen capture of that list and post it here. Does it look similar to this one?

Done, and yes it does look like yours

 

[Golden]

Yep - you have the same update as me awaiting too KB976902 10.2MB.

Try those 3 steps I outlined above, and then report back. I'm going to ask Corinne (one of the resident security experts) to have a look at this too. Please follow all her instructions.

Regards,
Golden

EDIT : I've asked Corinne to have a look at this when she gets some time. Please be patient as she may be busy with other things. We will sort you out - dont' worry

 

[Willowhoop]

I have a strong suspicion this is a false positive, but I've just trawled the AVAST forums and cant find an issue related to the Windows updates. We really need an experienced AVAST user to help out here, to see if they have experienced similar issues, and if they know how to fix it.

In the meantime please do the following in this order:

1. Scan your PC using that ESET link I posted earlier.
2. If the ESET scan comes up clean, then ensure that AVAST and its database are up to date.
3. Try to download the Windows updates again.

Post back with the results.

Regards,
Golden

*** EDIT : in the AVAST blocking window is the process quoted called CSC.EXE, as shown in this image below.

*** EDIT2 : The AVAST forums have a lot of messages about suspected false positives several times a day related to strangely named .dll's. It appears that the culprit may be this CSC.EXE process. See here Win32:Malware-gen popping up

Lets see what other forum members can add.

Yes that image you have attached is the same as the ones I have had coming up. I haven't had time to snip and save them. I have been keeping everything updated. My Avast says that it is up to date and yet there is another red box popping up saying that the last update was unable to complete?? I have been looking into it, but I'm not having much luck as I really don't know what I am looking for, hence being here and asking. I never do anything I don't understand without asking first. Most of the time its logical and I can figure it out... this one has me a little perplexed, to say the least. I'll do some more prowling around and keep you posted too.

 

[Willowhoop]

I have a strong suspicion this is a false positive, but I've just trawled the AVAST forums and cant find an issue related to the Windows updates. We really need an experienced AVAST user to help out here, to see if they have experienced similar issues, and if they know how to fix it.

In the meantime please do the following in this order:

1. Scan your PC using that ESET link I posted earlier.
2. If the ESET scan comes up clean, then ensure that AVAST and its database are up to date.
3. Try to download the Windows updates again.

Post back with the results.

Regards,
Golden

*** EDIT : in the AVAST blocking window is the process quoted called CSC.EXE, as shown in this image below.

*** EDIT2 : The AVAST forums have a lot of messages about suspected false positives several times a day related to strangely named .dll's. It appears that the culprit may be this CSC.EXE process. See here Win32:Malware-gen popping up

Lets see what other forum members can add.

Yes that image you have attached is the same as the ones I have had coming up. I haven't had time to snip and save them. I have been keeping everything updated. My Avast says that it is up to date and yet there is another red box popping up saying that the last update was unable to complete?? I have been looking into it, but I'm not having much luck as I really don't know what I am looking for, hence being here and asking. I never do anything I don't understand without asking first. Most of the time its logical and I can figure it out... this one has me a little perplexed, to say the least. I'll do some more prowling around and keep you posted too.

Just managed to catch one for you

 

[Golden]

OK. Just saw your image : yes its the CSC.exe problems again as posted by other users on the AVAST forums. (see link posted earlier)

Look out for Corinne's post/s when she visits here - her suggestions/advice/instructions should take precedence over anything else.

Regards,
Golden

 

[Willowhoop]

Yep - you have the same update as me awaiting too KB976902 10.2MB.

Try those 3 steps I outlined above, and then report back. I'm going to ask Corinne (one of the resident security experts) to have a look at this too. Please follow all her instructions.

Regards,
Golden

EDIT : I've asked Corinne to have a look at this when she gets some time. Please be patient as she may be busy with other things. We will sort you out - dont' worry

Thank you. I'm in no hurry and going nowhere except to get some sleep. Its just gone past 3.10am here. Will check in when I'm up and about.
Thanks for the Avast forum too, interesting reading. Have registered and will watch proceedings.

Cheers, and have a good day.

 

[Willowhoop]

ooooo, Malware scan completed

For some reason (you may be able to rectify), I click on the link to run the online scan you suggested and nothing happens?

I'm running MSE now, and prelim scan shows that malicious or potentially unwanted software might exist on my computer. Will let you know more after scan completes. (& yes I'm supposed to be hitting the mattress, but I have to fix this... lol)

 

[Corrine]

Hi, Willowhoop.

I see you also posted in the Avast thread. Good move. As you will see from that thread, there has since been an Avast definitions update and members are now reporting they are no longer receiving the warning.

That said, the .dll's you posted in your screen capture plus the fact that MBAM identified a trojan leads me to believe a combination of issues here, first the Avast f/p t hat appears to have been rectified and second, what MBAM has detected as a trojan.

I suggest you allow MBAM to quarantine what was found and update Avast and see what the results are. If problems persist, I suggest a System Restore to prior to the Windows Update, followed by an updated MBAM scan. Then update Avast to the latest definitions. When you are certain your computer is clean, check again for Microsoft updates.

 

[acurasd]

I also would suggest this because that way you will be out of windows and they will be unlocked to delete...

FREE Bootable AntiVirus Rescue CDs Download List

 

[Golden]

Hi Willow,

In summary, you had a mixture of false positive (FP) from Avast, and an unrelated trojan picked up by MBAM.
Please follow Corinne's suggestions. If you need help with any of that then please post back here.

Regards,
Golden

 

[Willowhoop]

Thank you all so much.

Corrine, I shall do as you suggest, and repost if anything does not rectify itself.

Golden, you rock!!

 

[Golden]

Hey, its all part of the Windows7 forums service! I certainly wouldn't have been able to help if it hadn't been for everything I have learn't from all the members here

 

[Corrine]

Thank you all so much.

Corrine, I shall do as you suggest, and repost if anything does not rectify itself.

You are welcome.

Golden, you rock!!

Words like that are why we do what we do. Great job, Golden, following this one through.

 

[Willowhoop]

Hey, its all part of the Windows7 forums service! I certainly wouldn't have been able to help if it hadn't been for everything I have learn't from all the members here

I too am learning a lot. I spend time just reading through posts, not to be a nosy dora, but to hopefully learn more, and I think I do. I love Win7, never thought I'd move away from XP, but Win7 is by far a more superior OS in all ways. Having it, and a beaut new PC has motivated me to learn more.

I nearly forgot to mention that I couldn't get Eset to run last night, its running now. MBAM has quarantined the trojan, and all seems well now. I will only post the Eset scan if I have an queries.

Thank you again hun