avg detected nircmd.exe trojan

[cdoolake]

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 08:43 on 23/11/2009 by Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "nircmd.exe"
No files found.

-=End Of File=-

the kaspersky online scanner is being updated at this time and is not available to download...the only thing u can get is the internet security trial package .....i uninstalled the two java programs and installed the newest one.

[xixo_12]

Hi,
Let's try another one.

Next,
ESET Online Scanner
Go here to run an online scannner from ESET.

• Note: You will need to use Internet explorer for this scan
• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked
• Click Scan
• Wait for the scan to finish
• Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
• Copy and paste that log as a reply to this topic

Next,
Checklist.
Please post.

• Content of log.txt

[cdoolake]

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=75240a5627c6bc4f9c144f5d2f3bc85e
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2009-11-24 05:54:40
# local_time=2009-11-24 12:54:40 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 18709 18709 0 0
# compatibility_mode=1024 16777215 100 0 32829899 32829899 0 0
# compatibility_mode=5892 16776573 100 100 0 95638527 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=214131
# found=0
# cleaned=0
# scan_time=11208

[xixo_12]

Hi cdoolake,
Good!
Your system now is clean.

I do feel the detection by AVG is False Positive.
nircmd.exe is just part of a NirSoft tool. Sometimes it's refer to our own tool related with malware removal (If you got the help from any anti-malware forum)
Don't feel so worry about it.

Please note: Due to the restrictions on Vista, all tools should be started by Right-Click ---> Run As Administrator

Here is my advices :

Malwarebytes' Anti-Malware.

• Malwarebytes' Anti-Malware is a new and powerful anti-malware tool
• Only realtime protection need to pay.
• Tutorial on installing & using this product can be found below:
  
  • Description and download
  • How to install and run?

WinPatrol.

• Unwanted things always occur behind your knowledge. Let's this software take the snapshot of it.
• For more information and installation can be found HERE

Windows/Program Update.
Windows Vista
Update your Windows regularly.
Any doubt on how it can be done, please refer HERE

You always can refer at both website to check either any updates are needed for your system.

• Secunia Software Inspector
• F-secure Health Check

Information.

• Please check out Tony Klein's article "How did I get infected in the first place?"
• Read some information here how to prevent Malware.
• Is your pc running slow? Read What to do if your Computer is running slowly

Happy safe surfing!

[cdoolake]

Thanks for all your help!! This has definitely been a learning experience......

[xixo_12]

You're welcome