Avast says I have a virus! Help

Viruses and worms
1

Hi everyone, new here! Avast says I have a virus on my computer. It popped up and scared me so much! I don’t know what to do. It says recomended ‘move to chest’ but everytime I try to move or delete it it says that it cannot be processed and the file is read only or something. I’m scanning it as we speak and it says infected count 2! I don’t know what has caused this. I’m doing a scann on windows defender aswell. What should I do saying I cannot delete it?

Many Thanks.

2

Hi Meggymoo,

Not an expert but I am an average avast forum user. As a rule of thumb you have to give a bit more details. When you get the virus found message, mark down the file path i.e. C:\windows\something something or C:\something or D:\something. Also write the type of virus it is. Without this no one can really give much help.

Best of Luck

3

Hi Sorry,

Last infected:

C:\WINDOWS\SYSTEM32\USER32.DDL and it says somthing like [WRM]?

I have no idea what that means? But I hope it helps
Why can’t I move it to the chest?

Many Thanks.

ps. Windows defender says everythings ok ?

4

Is it Win32:SysPatch?

5

Meggymoo, is your avast virus database updated?

6

Yes it is.

and everytime I try to move to chest it says it cannot be processesd because it is read only.

As far as I kno. It updates daily.

Thank you very much!

7

Meggymoo -

This should have already been fixed. Please try a manual update.

Right click the “a” ball in the task bar > Updating > click on iAVS Update

8

The problem is this is an important system file, even though it is infected it will be in use and protected so avast can’t move it to the chest, it could have major consequences if this file is removed.

I also assume that you meant c:\windows\system32\user32.dll and not .DDL that typed ?

There are some other topics relating to a similar issue with Win32:SysPatch, but with a different file name, you might be able to get some information there. http://forum.avast.com/index.php?topic=41227.0

This post in that topic also relates to user32.dll, http://forum.avast.com/index.php?topic=41227.msg346083#msg346083.

This post, mentions that the DrWeb CureIt tool can detect and clean this one,

So I suggest you give that a try.