Help! In Avast Virus Chest I have 1 rtk virus and 2 trj viruses

Viruses and worms
1

Hello, I appreciate any advise you can give me as I am a novice and this is the first time I’ve ever gotten a virus.
I downloaded and ran Avast when antivirus AVG & SuperAntiSpyware would freeze up and have since deleted them. The Windows Live safety scanner also froze up. I cannot tell you much about how I contracted the viruses as my son was using my computer at the time.
I now have on my PC, Avast, Ad-aware, and Malwarebytes.

I have the following in the chest and I don’t know where/what to do from here. I’ve tried looking them up by the virus name and don’t find anything on Avast I forum nor google. I think one is definitely in a system .dll and don’t know about the Recycler C and D.

I am typing these out as I don’t want to copy and paste from the chest.

Name: gxvxcjtxyhqmxwfdaqndynfttintqiipqvint.sys
Original location: C:\Windows\System32\drivers
Last changed: 5/19/2009 12:47:38 PM
Transfer time: 5/20/2009 7:46:25 PM
Virus: Win32:Alureon-AT [Rtk]

Name: S-0-4-14-100022117-100011470-100009164-5761.com
Original location: C:\RECYCLER
Last changed: 5/18/2009 3:01:12 PM
Transfer time: 5/20/2009 6:42:42 PM
Virus: Win32:Jifas-AV [trj]

Name: S-0-4-14-100022117-100011470-100009164-5761.com
Original location: D:\RECYCLER
Last changed: 5/18/2009 10:01:12 PM
Transfer time: 5/21/2009 2:40:27 AM
Virus: Win32:Jifas-AV [trj]

One of the “help yourself” instr. said to make sure that your system is updated, well my Windows update will not install updates with error code 80244019 and I’ve taken the measures advised to restart services required by Windows Update after I quarantined the virus and still am unsuccessful installing updates.

I also installed Spyware Doctor by pctools and could not get the initial required update to complete successfully to even be able to commence Spyware Doctor scanning of my PC so I have deleted that one for now.

This may have been the wrong thing to do, but after I had quarantined the viruses I recovered my PC to a date before contracting the viruses, however, when I tried to reinstall Avast, the setup wizard would never appear to complete installation, so I undid the recovery so I would still have Avast and am in the present state of having the viruses in the chest.

Thanks for your help in what to do next with items in the chest and subsequent procedures.

djhp

2

They both have strange name on my opinion and no google results found. So the files on the drivers and other found on recycler are a bit strange too. So if i was you i would delete or wait another respond from a member of the ALWIL Team or Users of the forum.

Mr.Agent

3

Try the Avira rescue cd, it is excellent ( when it works )
You have a nasty rootkit. If you cannot run the disc, you could post a log from rootrepeal, or run combofix

Rescue disc http://forum.avira.com/wbb/index.php?page=Thread&postID=730130#post730130

Rootrepeal http://www.malwarebytes.org/forums/index.php?showtopic=12709

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

4

By the names and location alone I believe the detections to be good, leave them in the chest (where they can do no harm) for a few weeks and scan within the chest, they should be detected again, it is safe to delete them from the chest after that check.

The ?:/Recycler is a common dumping ground for malware and is commonly going to have other malware associated with this.

The same is true of the system32/drivers location and could be an indication of a more serious infection.

5

Download Hijack This, run it, and select “Do A System Scan and A Savelog File”. After the scan is finished, a text document should pop-up. Highlight all of the text and then right click. Then click copy. Now go to this topic and select new post.

Then right click and click paste. If its too long, highlight at least half of it, right click, and select cut. Then click your post button. After that, wait 20 seconds. Then click new post again. After that, right click and select paste. It should show the other part of the log. Click post again. After that, all you got to do is wait for someone to analize your Hijack this log.

Edit: Beat by DavidR. ;D

6

Hijackthis for this is like a band aid for a .45 head wound, it just isn’t up to the job. Rootkits won’t be found by HJT.

micky77 was quicker than both of us and on the money.