I went from the free avast to a purchased avast program version 6.0.1289. I then did a boot scan. It found some viruses, I think trojan or worm, I didn’t write it down. It would not let me delete, repair, or move to chest. The only option that worked was ignore so that virus is still on my computer. I thought when I purchased avast that would have solved that problem but no. Any suggestions?
Look in the C:\Documents and Settings\All Users\Application Data\Avast Software\Avast\report\aswBoot.txt file (XP location) C:\ProgramData\Avast Software\Avast\report\aswBoot.txt (Vista, Win7 location), check this file using notepad for info on the scan/detections, etc.
Copy and paste the entries for the detections.
Thanks I did that and this is what I’m talking about:
Desktop\KiweeToolbar_VGNKIW29191_1.3.118.msi|>_AB18C1B2C08CDE35AFB57346A4551D9A|>_255311685EC0439E9B51F19CA2877AB9 is infected by Win32:Trojan-gen, Delete: Error 42111 {The operation is not supported for this type of archive.}, Move to chest: Error 42111 {The operation is not supported for this type of archive.}, Move to chest: Error 42111 {The operation is not supported for this type of archive.}, Repair: Error 42060 {The file was not repaired.}
and
File F:\System Volume Information_restore{C9A1DFC6-8E2C-4923-B567-1530A006D07D}\RP1812\A0574666.msi|>_AB18C1B2C08CDE35AFB57346A4551D9A|>_255311685EC0439E9B51F19CA2877AB9 is infected by Win32:Trojan-gen, Move to chest: Error 42111 {The operation is not supported for this type of archive.}, Move to chest: Error 42111 {The operation is not supported for this type of archive.}, Delete: Error 42111 {The operation is not supported for this type of archive.}, Repair: Error 42060 {The file was not repaired.}
How do I fix this?
The .msi file is likely to A) be unable to extract the file from within this installation file without corrupting it {The operation is not supported for this type of archive.}, B) unless it is a true virus (a small part injected into a file) it can’t be repaired and C) even if it could be sent to the chest, it is likely to exceed the maximum file size for the chest, if you had the option to deal with the whole archive. However, point A {The operation is not supported for this type of archive.} would apply as it would have to be extracted from the archive.
The one in the F:\System Volume Information_restore location appears to be the same file, the attempt to move it may well have triggered system restore to create a restore point for it.
What to do you could manually delete the one in the F:\System Volume Information_restore point. Presumably you have installed the KiweeToolbar that this .msi file relates ?
So that could be removed, but it also begs the question why it is on the desktop and not somewhere like the downloads folder, etc. So if you have installed the KiweeToolbar you could remove the KiweeToolbar_VGNKIW29191_1.3.118.msi from the desktop.
However the KiweeToolbar site doesn’t have a good reputation, http://www.mywot.com/en/scorecard/kiwee.com, So I would happily get rid of it and also uninstall the KiweeToolbar if you did install it.
Hi, beatlefanLH!
Yes, it might belong to Kiwee Toolbar - as DavidR said. You could also run a scan with Malwarebytes® Anti-Malware to scan for further infections (it will remove Kiwee Toolbar if it’s listed in MBAM’s database)
’ Note: always update your Malwarebytes® Anti-Malware before scanning!
So, try to remove the toolbar and then clear your system restore points by turning System restore off, then on.
On Windows XP: Right click on the “My Computer” icon → Properties → System Restore tab → Tick the “Turn off System Restore” checkbox → Reboot if it asks You → (After reboot) Right click on the “My Computer” icon → Properties → System Restore tab → Uncheck the “Turn off System Restore” box → (Reboot again if it asks You)
On Windows Vista/7: Right click on the “Computer” icon → Properties → “Special System settings” - or something like this → System restore tab → Settings… button → Click the “Delete” button at the bottom of the window.
I hope I could help.