Hello you good people of the avast forums,
I only discovered the site today as a result of a search engine search for “aswboot.exe”. I was promoted to do this when Spybot S&D informed me of a registry change involving this file. Anyway I solved the problem with reference to this good site. In the process I learned that it’s posssible to schedule an Avast boot scan so I did just that, that’s the easy part. To my great surprise the scan revealed a vast number of discrepancies and some malware as follows:
06/14/2008 20:36
Scan of all local drives
File C:\Applications\Tool\Microsoft Windows XP Updates\WU\WindowsXP-KB826939-x86-ENU.exe_sfx_0004.p Error 42127 {CAB archive is corrupted.}
File C:\Applications\Tool\Microsoft Windows XP Updates\WU\WMP9_MM2.exe\setup.exe\sample.wmv Error 42127 {CAB archive is corrupted.}
File C:\Applications\Tool\Microsoft Windows XP Updates\WU\WMP9_MM2.exe\setup.exe Error 42127 {CAB archive is corrupted.}
File C:\b85ed6347264b814d3\wcu\dotNetFramework\dotNetFX20\ASPNET.msp\PCW_CAB_NetFX\FL_System_Web_Mobile_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\My Downloads\Drivers\Graphics - Video\CLE266_16-94-44-45_XP_Rotation_logod.zip\CLE266_16944445_XP_Rotation_logod\vtdisp.dll Error 42125 {ZIP archive is corrupted.}
File C:\My Downloads\Open Office\OOo_2.0.1_Win32Intel_install.exe$INSTDIR\openofficeorg3.cab\reflection.uno.dll Error 42127 {CAB archive is corrupted.}
File C:\Program Files\Microsoft Works\WKSv7std.sbt\147033 Error 42136 {CHM archive is corrupted.}
File C:\Program Files\S3\S3\s3setvga.exe is infected by Win32:Otwycal-AF [Wrm], Moved to chest
File C:\System Volume Information_restore{1A2E542A-B4FA-4FE1-ADA7-F7DED0643FF0}\RP295\A0059552.dll[Embedded#22250] is infected by Win32:Trojan-gen {Other}, Moved to chest
File C:\System Volume Information_restore{1A2E542A-B4FA-4FE1-ADA7-F7DED0643FF0}\RP299\A0059977.exe is infected by Win32:Otwycal-AF [Wrm], Moved to chest
File C:\WINDOWS\Help\odbcjet.chm$WWAssociativeLinks\Data Error 42136 {CHM archive is corrupted.}
File C:\WINDOWS\I386\ARTICLE.CH\article.chm\hn_topology24.gif Error 42136 {CHM archive is corrupted.}
File C:\WINDOWS\I386\ARTICLE.CH_\article.chm Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\10592f19.msp\PCW_CAB_NetFX\FL_System_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\10592f1d.msp\PCW_CAB_NetFX\FL_SYSTEM_WINDOWS_FORMS_DLL_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\1bb290.msi\Icon.NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe Error 42145 {OLE archive is corrupted.}
File C:\WINDOWS\Installer\1bb290.msi\Icon._7EA1FFEF_B7AE_43A5_8841_DBB045C2D037 Error 42145 {OLE archive is corrupted.}
File C:\WINDOWS\Installer\213dae.msp\PCW_CAB_NetFX\FL_alink_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\23287f5.msp\PCW_CAB_NetFX\FL_SYSTEM_WINDOWS_FORMS_DLL_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\238ded.msp\PCW_CAB_NetFX\FL_System_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\26a465.msp\PCW_CAB_NetFX\FL_prc_nlp_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\3a46a.msp\PCW_CAB_NetFX\FL_AspNetMMCExt_dll_66806_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\3b0613.msp\PCW_CAB_NetFX\FL_System_Design_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\3bcf60.msp\PCW_CAB_NetFX\Microsoft.JScript_dll_2_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\47c50.msp\PCW_CAB_NetFX\FL_cscomp_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\496e0.msp\PCW_CAB_NetFX\FL_sysglobl_dll_92791_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\5a6e03.msp\PCW_CAB_NetFX\mscorwks_dll_4_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\5a6e05.msp\PCW_CAB_NetFX\dw20.exe_0001.D0DF3458_A845_11D3_8D0A_0050046416B9 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\77fe52.msp\PCW_CAB_NetFX\FL_System_XML_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\89f7d4.msp\PCW_CAB_NetFX\FL_WebAdminWithConfirmationNoButtonRow_mas_102343_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\c159c.msp\PCW_CAB_NetFX\FL_shfusion_dll_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\d3ef0.msp\PCW_CAB_NetFX\FL_big5_nlp_____X86.3643236F_FC70_11D3_A536_0090278A1BB8 Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\Installer\d56b011.msp\PCW_CAB_NetFX\msvcp80.dll.8.0.50727.1433.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E Error 42127 {CAB archive is corrupted.}
File C:\WINDOWS\ServicePackFiles\i386\msncli.exe\msnmetal.dll Error 42127 {CAB archive is corrupted.}
Number of searched folders: 9864
Number of tested files: 333994
Number of infected files: 3
I instructed the malware to be moved to the chest but noticed that some of it was located in “System Restore” so does this mean I will have to delete my system restore in order to remove these or are they safely locked away in the chest?
I should say that immediately after the boot scan I ran scandisk with the two correction and repair boxes ticked before running. I think this may repair some of the corrupt files, is this correct?
Would some kind soul please take a look through and diagnose the problem and advise on any remedial action.
Thanks