Hi all,
I’ve a strange behavior on my computer. I did a full hd scan, and avast found a Win32 Agent DZT trojan today. After that I’ve seen that zone alarm and avast was disappeared. I’ve tried to reinstall Avast but everytime I’ve finished to do it, the avast application disappear as someone delete it. I think there’s something malicious that prevents from installing an antivirus or a firewall.
Please someone help me, I’m thinking about formatting everything.
What is you operating system?
Any other av installed?
What file was infected and what did you do with it? ie delete, move to chest
It may have been a false positve, as other users are reporting finding the same “trojan” in various files asociated with games.
http://forum.avast.com/index.php?topic=25719.0
Did you uninstall avast defore you tried to reinstall it? I don’t think you can install avast if it is still installed. You may need the avst removal utility
http://avast.com/eng/avast-uninstall-utility.html
/ What is you operating system? /
Win 2k Athlon 1Ghz 320 MB Ram
/ Any other av installed? /No
/ What file was infected and what did you do with it? ie delete, move to chest /
A file inside a FIFA 2003 game and another one in WINNT directory
Thanks to your help, I’ve downloaded, removed and reinstalled Avast.
The strange thing is I cannot find also: Spybot search and destroy, and the principal executables of Zone Alarm didn’t exist anymore, altough the services seems still working . To try to get rid of the situation I’ve uninstalled ZoneALarm and when I’ll go home I’ll install again and I’ll let you know.
Thanks for your help
BTW: Sometimes when I open IExplorer I see the top bar (the one with the close and minimize button) flashing like if someone is switching between windows.
Any clues?
Situation update-
After the clean install of avast that seems to be working, last night, I went back home and found that avast was disappeared again from task bar, and exes from avast4 folder. I’ve run an etrust antivirus online from CA site and this morning wasn’t found any virus.
So, probably the trojan was removed but something was written, somewhere, that prevent me to reinstall any of the security tools mentioned before. (Avast,Zone Alarm, Spybot search and destroy).
I’m really really near to: format c: :-\
Please, try before full computer on-line scanning:
Kaspersky (the best!)
Trendmicro housecall
Ewido
Are you using Spybot S&D TeaTimer ?
That can kill the avast icon (start-up entry).
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode.
- Ewido, a.k.a. avg anti-spyware If using winXP. or a-Squared free if using win98/ME.
Also useful as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2 or HiJackThis Tutorial 3
On-line analysis - HiJackThis Log file - On-line Analysis OR HiJackThis Log file - On-line Analysis 2
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
X-RayPc Spyware Remover Process Analyzer http://www.x-raypc.com/
I have the exact same problem. Plus I also lost the Spybot S&D exe file and neither my online hearts nor spades game will work.
And I have no idea what file caused it. I just noticed that my Spybot icon and my Avast icon dudnt have a pic… just a plain white box.
I have no idea how to use hijack this or anything else like that, but i am willing to learn.
What do I do first?
Danny
Read the hijackthis tutorials and then download the program.
I’ve had the same problem as TAFKAS and DaKing. :-
What I did to resolve it? After installing avast! I just assigned attribute “only for read” for folder where avast! has been installed, then I planned boot-scan. I can’t remember what virus it was but with this way I resolved avast’s and some security progs disappear.
By my mind assignment attribute “only for read” and redistribution of the rights of the access to files can help. 8)
Well I haven’t changed my avast (Alwil Software) folder settings and mine is set to Read Only, as are the sub folders.
DavidR, very interesting. After each installation my avast folder and subfulders aren’t set to read only. ???
I don’t know if it has anything to do with the OS and HDD format but I’m on XP Pro and my partitions are FAT32 I never changed to NTFS when I upgraded from win98se.
I’ve had avast for 2 years 9 months and in that time it has had several updates, beta versions, reinstalls, etc and I have never changed the folder options for any of them. Some time ago there was an issue of privilege escalation that could allow deletion or modification, but that was changed some time ago.
Where are you installing avast? I mean, which is the full path?
I don’t install to the default location but to D:\Program Files\Alwil Software\Avast4
Tech, I as DavidR don’t install to the default location and the full path is C:\Program Files\Avast4
I’ve asked because the inherit of the access rights done by Windows XP.
If C:\Program Files\ is %Program files% folder, everything will be ok. But if you install to a folder out of that %Program files% branch, well, there is a possibility of messing the access rights to the folder, at least in theory. Then, strange things could happen on installation…
I have the same problem as Tafkas and Daking (disappearing avast, spybot, zonealarm)… I’d really love to know if you got to the bottom of it.
I’m going to start a new thread (hope that’s the right thing to do).
crusoe, please, read posts of users leni and XerraX in topic Missing avast exe file. May be it will be helpfull for you. 
in the case of the last post it appears the rustock rootkit is a real possibility so maybe you guys should consider excluding that as well.
online scan at F secure detects it
http://support.f-secure.com/enu/home/ols.shtml
also spysweeper. http://www.download.com/Webroot-Spy-Sweeper/3000-8022_4-10301356.html