File not found

I have just installed Avast home, and I am constantly told I have Win32:Trojano-1426(trj).
Avast says it is in C:\windows\SvcProc.exe, however when I try to do anything with it Avast says the above file cannot be found. ???
Can someone help me with this as I cannot even clear the warning off the screen, so I have to disable Avast, which I don’t want to do.

I suspect that the virus may be in memory: some clever viruses delete the file that they run from when they are loaded into memory and then rewrite it you before your computer shuts down.

To defeat such a virus trick, a boot time scan is necessary. This should delete the file before it has a chance to load into memory. (This doesn’t work in Win 98: if you have this OS, boot into safe mode before scanning- hit F8 while booting.)

Right click the avast! globe and select Start avast! Antivirus.

avast! will do a memory scan: if it finds the worm in memory, it will prompt you to do a boot time scan: accept this and reboot.

If avast! doesn’t find anything in memory, schedule a boot time scan. (Click the button at the top left of the avast! silver console and select Schedule boot time scan from the drop-down menu.)

Please ensure that you have a firewall and that your OS is up to date, otherwise infections will come back. A computer connected to the internet will be attacked by worms, viruses, Trojan horses and spyware within 40 seconds. You can prevent all of this by installing a free firewall. and updating your OS.

If you need advice on either of these subjects, please say so.

I think it is also possible to start computer in safe mode and then scan computer. I don’t remember if it is possible to Schedule boot scan with Avast Home.
To start computer in save mode:
win /xp2000 - press F8 at booting time.
win 98 - Start>Run write “msconfig”, run it, I think there is “Advaced” Press it and mark Safe mode or Boot choise

If you find a virus keeps coming back after you delete it, it’s most probably infected the System Restore folder, the best way to solve this is to disable System Restore, reboot your machine and then enable it again. After all, run a full avast! scanning. System Restore cannot be disabled on Windows 9x.

I suggest:

  1. Disable System Restore (enable it at the end of scanning/cleaning):
    Windows ME: http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264887
    Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405

  2. If you have XP: Schedule a boot time scanning (Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot).
    If you have Windows 98\Me: boot in SafeMode (repeatedly press F8 while booting): http://support.microsoft.com/default.aspx?scid=kb;en-us;315222

  3. A full scanning with avast, Ad-aware, SpyBot and Microsoft Antispyware :wink:

Thanks guys. The only thing I haven’t done yet that you suggested is to disable sysyem restore. I have tried all the other options you suggest and they don,t work, so I will try that. :slight_smile:

The file reported as infected, C:\windows\SvcProc.exe, is not a windows file but adware so I’m surprised with the symptoms you discribed.

Can someone help me with this as I cannot even clear the warning off the screen, so I have to disable Avast, which I don't want to do.
You can click the X at the top right of the alert window to get rid of it rather than disable avast. I suspect that there may well be something else going on.

If you haven’t already got this software (freeware), download, install, update and run it.

  1. Ad-Aware
  2. Spybot Search and Destroy
  3. Spywareblaster

Also useful as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial
For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.

Thanks DavidR, but unfortunately clicking the cross at the top right doesn’t work, as the warning comes right back again!
Spybot cannot find it, nor can Adaware, haven’t tried the last program you suggested, so I will try that next.
Will try all you suggested, but if that doesn’t work I’ll be back :stuck_out_tongue:

This is why I think there is another problem, possibly unrelated to the problem with this virus warning.

How was this file detected, during a routine scan, after a download?

I should have asked in my last post, what is your OS? as you wont find system restore if you have win98. If you have ME or XP then disable system restore before doing any thing else other wise you will have an infected restore point (that if you ever used it would put the infected file back).

I have win xp, and it was found during a download.