AVAST error 42111 ???

Viruses and worms
1

Did a boot scan and found 3 files infected with (JS:Agent-DRN)(Trj). but avast can’t move to chest/repair/delete it - “error 42111: the operation is not supported for this type of archive”

c:\system_volume_information\Windows_Backup\Staging{135b1315-a5a7-4bd6-8920-af8184a773d4}\Backup_files.49.zipl>c\users\tom2\Appdata\Roaming\Mozilla\Firefox\profiles\kn1z0h3g.default\extensions\o2Juj4alth@q.net\content\bg.js

c:\system_volume_information\Windows_Backup\Staging{135b1315-a5a7-4bd6-8920-af8184a773d4}\Backup_files.49.zipl>c\users\tom2\Appdata\Roaming\Mozilla\Firefox\profiles\kn1z0h3g.default\extensions\77@0k\edu\conent\bg.js

c:\system_volume_information\Windows_Backup\Staging{135b1315-a5a7-4bd6-8920-af8184a773d4}\Backup_files.49.zipl>c\users\tom2\Appdata\Roaming\Mozilla\Firefox\profiles\kn1z0h3g.default\extensions\KG@1Mu1MgD2V.edu\Content\bg.js

I have included the Avast virus log. Please help.

2

Attach your basic diagnostic logs. (MBAM, FRST and aswMBR)
Instructions: https://forum.avast.com/index.php?topic=53253.0

3
c:\system_volume_information\Windows................
Delete old / all restore points
4

Please find logs attached. Deleting restore points didn’t help

5

OK, now you’ve to wait a bit…

6

Hello,

https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

[*]Right-click on
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/51a612a8b27e2-Zoek.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[]Wait patiently until the main console will appear, it may take a minute or two.
[]In the main box please paste in the following script:

createsrpoint;
autoclean;
emptyclsid;
emptyalltemp;
ipconfig /flushdns >>"%temp%\log.txt";b

[*]Make sure that Scan All Users option is checked.
[*]Push Run Script and wait patiently. The scan may take a couple of minutes.
[*]When the scan completes, a zoek-results logfile should open in notepad.
[*]If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Upload it in your next reply.

7

zoek attachments

8

How is the situation now?

9

Did another Avast Boot-time scan, nothings changed (exact same error and files).

10

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt). I don’t need it for review.

Tool deletes old system restore points and creates a fresh system restore point after cleaning.

11

As mentioned earlier above, reset your system restore points and detection will disappear.
Detections are by AV’s heuristic, not real malware and it can’t be deleted.
http://www.sevenforums.com/tutorials/81500-system-restore-enable-disable.html

By running DelFix and selecting Purge system restore option, system restore cache shall be emptied and detections will be no more.

Uninstall Free File Viewer 2012 and Final Media Player 2012 PUP programs and delete the following manual;
C:\Program Files (x86)\FreeFileViewer
C:\Windows\System32\Tasks\FreeFileViewerUpdateChecker

Uninstall Spybot as well, that is an old outdated software. Also, reset Google Chrome to defaults settins;
https://support.google.com/chrome/answer/3296214?hl=en

12

OK. Have finished all above tasks, but nothing has changed (same virus message when doing boot-time scan).

I am unsure if all restore points are deleted. When accessing ‘system restore’ , clicking on show all restore points, shows 10 older restore points (these appear to be on an external or old HDD).

I turned off the ‘heuristic’ scan setting in the Avast Boot-time scan and same virus error still showed up.

Are you saying that it’s a false positive and i should’nt worry?

13

Did you run Delfix?

14

Yes. Did everything that has been instructed.

15

Follow this guide to turn off System Restore

http://windows.microsoft.com/en-ie/windows/turn-system-restore-on-off#1TC=windows-7

16

If still a problem after TwinHeadedEagles last instructions

I am unsure if all restore points are deleted. When accessing 'system restore' , clicking on show all restore points, shows 10 older restore points (these appear to be on an external or old HDD).
post a screenshot of what you see here so THE can see
17

Still unable to remove those old restore points. Please find attached a screenshot of the message windows gives me (after I thought I had already deleted them).
Thanks

18

Did you try to turn off System Restore as I told you?

19

Yeah turned off system restore (as you told me).