Can't scan this bug with anything, started with win32.junkpoly-b

Viruses and worms
1

Hello

All

infection started with the junkpoly-b but something else exists, can’t seem to update upto date Avast definitions

bitdefender online scanner is seeing anything, neither is MBAM.

Anyone have any other thought?

Running windows XP sp3 Avast with comodo.

2

A fast response will be Dr.web live cd:
http://www.freedrweb.com/livecd/?lng=en
if it can making your pc some kind clean,we will ask you to post some logs

3

Do I down load the demo?

4

You can update the definations manually.
Get the latest from http://www.avast.com/download-update
After the update, run a bootscan with avast.
Let us know the result.

5

Still running the Dr.Web scan. So far Trojan.Siggen2.16874 was identified, and a suspicious fill BFU.exe.

Will run the avast after.

6

After cleaning with dr web ,you can scan with avast after updating it,AND no don’t install the de,o just work with the free version.
If you can boot normally to windows download Hijack Hunter and make a log
http://www.novirusthanks.org/product/hijack-hunter/
A hijack hunter review and simple tutorial:http://superhacker.blog.com/2011/02/06/hijack-hunter-reviewmore-than-simple-radar/

attach the log here in the forum.

7

I have attached the hijack hunter log and the log from DrWeb. I clicked on “move” after the doctor web scan, not sure if it did anything. DrWeb is currently the anti virus running. It keeps catching stuff.

8

Now we have some problem since you have installed dr.web not used the free version,anyway you can uninstall it and install avast!.
Dr.web resolve the problem and there is a small effort you should do now
1.from hijack hunter window go to restorer tab then check
Restore SHOWALL
Enable show hidden files
Enable show system files

then click apply,you may promoted to reboot or log off then follow the advice.

2.copy the folloing code to your command prompt and press enter


regsvr32 /u C:\WINDOWS\web\wallpaper\welcome\AWhelper.dll

3.copy the following code into command prompt and press enter


del /f C:\WINDOWS\web\wallpaper\welcome\AWhelper.dll

4.Scan now with avast and tell us if you have problems

9

Yes the DrWeb demo wouldn’t work. BUt before I remove DrWeb should i also delete the quarentined files in dr.web?

10

No left them BUT ENSURE NO ONE WILL RUN THEM better to edit the acls of them so no one can open them.
After that install avast and scan moved files AND DO NOT RUN THEM for your safety.
msdn.microsoft.com/en-us/library/ms229742.aspx
Any problem now?

11

Sorry for delay, was away for a bit.

Re installed Avast update scanned. Nothing, ran boot scan nothing.

Computer still seems very sluggish. And the funny thing is the fire wall and Avast are the last programs to start up :-\

Ran Hijack hunter again here is the log

12

Okay I will view the log,for the sluggish I suggest to follow the advices here:
http://superhacker.blog.com/2011/02/12/maintaining-my-windows/
Less than two hors I will tell you what happen in your pc

13

Your log looks clean,I suggest to follow advice in the upper post and the system speed will increase.
I wish I help.

14

Thanks for all your help ;D
Having trouble updating the .NET 3.5 upgrade, could that be the issue.

15

No it is not that issue,Uninstall it then restart then reinstall it from scratch.
You are welcome :wink:
superhacker