A trojan horse in the memory of my PC

Hi,

my computer has a file infected by virus, and this file can’t be processed (this the message of Avast 4.7 HE). I don’t know how to solve this problem. I need some help.

This is what happens:
-) i clicked on Avast 4.7 to make a scan of my computer;
-) when Avast 4.7 makes the ‘memory test’, it tells me that the memory is infected. The virus is a Trojan Horse in the file earcb1.dll.
-) trying to do the suggested operation Avast tells me that the file can’t be processed.

What can I do to solve this problem?

Thank U so much for the attention U will be able to give to my case

Try doing a boot-time scan (see pic).
Also, run ewido (http://www.ewido.net/en/)

I cannot do the first operation U suggested me becuse my versione of Avast 4.7 HE don’t let me click on it.
So, i’m going to do the following one.

Will it be enough to solve the problem?

DaBruni

Why not? ??? Strange…
Can you do a repair of avast? Go to “add/remove programs” click the “remove” button and when avast pops-up, click on “repair”.
Does it work now?

Well, try it and we’ll soon find out :wink:

I clicked on ‘repair’ but still doesn’t work

OK, try ewido.
Update it first.
It has a memory scanner, but I suggest you let it perform a full system scan.

Try ewido, as posted, or schedule a boot-time scanning:

Click on the Menu button.
Choose Schedule Boot Time Scan.
Doing so displays a dialog allowing you to schedule virus scanning.
Check Archives, if you want scan all the archives.
Specify whether all the disks or just a specific folder should be scanned.
Select Advanced options for scheduling details.
Select how to automatically process infected files.
Choose how to automatically process infected system files.
Click the Schedule button to confirm the settings.

I’m starting to be scared about my PC’s health !!!

I mean, when i click on ‘scan now’ at ewido this is the message that appears to me:

Microsoft Visual C++ Runtime Library
RUNTIME ERROR
Program: C:\Programmi\INTERNET EXPLORER\IEXPLORER.EXE

This application has requested the Runtime to terminate it in an unsual way

So, at the time, i couldn’t do anything, considering that i can’t choose Schedule Boot Time Scan from my Avast.

Run C:\Program Files\ALWIL Software\Avast4\sched.exe /A:*
Boot

I did run sched.exe and then did the boot.

After that, Avast doesn’t tell me the ‘memory is infected’, anymore.

Possibly a false positive.

What does it mean?

A false positive detection is a wrong detection from avast, i.e., the file is clean (not-infected) but due to an avast error (on virus signatures) it’s actually detected (now) as being infected.