How to clean a virus

I’ve read about the Avast! cleaner that can fix only some virus not all of the them . What have I to do against them ???!!!
Thanks a lot. ::slight_smile:

Hi,

is your PC infected with a (specific) “virus”, that’s not in the CLEANER’s list ?

Then please work through the link “VirusRemoval” below in my signature, and come back with specific info, e.g. Virusname & location/Folder/Filename

if not:

  • only a very few “viruses” can be cleaned/repaired,
  • other “infected” files like trojans/worms have to be deleted or,
  • if it’s a destructive malware that damaged/deleted vital system files: restore them from backup, e.g. your own backup or avast’s VRDB

Morale: Secure your system, so you don’t get (active) viruses/malware on your PC

Details: also in the mentioned “VirusRemoval”-link and in links in there :wink: and basically all over the board here
:wink:

Thank you.
I’ve read only a part of all your advices (I’ll do later the remainder ) . I see many online scanning sites and moreover they give the fix tool … where is their profits ?

Avast ! says that a file is a Virus Win32:Trojan-gen.
Kaspersky,AVG and Trendmicro say the system is not infected.
Then it can be a false positive…isn’t it ?

It could be. submit the file to JOTTI and let us know the results.

only a very few "viruses" can be cleaned/repaired,
Not true. Every virus, or better every file that is infected with a virus can be cleaned. That is one of the characteristics of a virus. If a infected file can not be cleaned it is not a virus, but other malware.

Some explanations/definations can be found HERE

Hi Eddy,

a) that’s why I set “virus” in “” as I didn’t want to get into this discussion (e.g. avast CLEANER in conjunction with Virus is quite a bit misleading apart from e.g. Parite)

b) not strictly true either, some file-infectors are damaging → not cleanable as such that after Code removal the host-file will run properly…

& if “CLEANABLE =removing Code” is one of your definitions of a true virus: I can also CLEAN trojans then …

;D

Maybe a malware…
I attach the Jotti log…

PS- what is this atlvb32.exe ?.. I’ve analyzed epid.exe !

I’ve also analyzed Hijackthis log in that your site online and get >>>> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
that have to be fixed ! It seems really strange …

Thanks a lot.

atlvb32.exe is a file thas was scanned and found infected before you ran a scan.

Thank you.
About Hijackthis log analyzer …could you tell me your name in "LinksFolderName = " ?
I suspect that the request to fix this entry is because of my lenguage …
Many thanks.

The analyzer doesn’t know everything and is far from failsave; neither are we, but please post the complete HJT-Log here :wink:

Many thanks, I attach the log.

Ps- Can I insert an image only with a URL ?

Log seems clean (is this the complete log…?);
I don’t think the collegiamenti is a problem

do you know the URL/adresses in the R0/R1 entries… ?

Do you experience any problemns with the PC at all ?

rescan EPID.EXE with Jotti, and if still only avast detetcs it:
→ please send it in as a false positive to:
virus (at) avast.com
best put it in a pasword-protected ZIP or RAR

Also work through the link “VirusRemoval” below on how to secure yoru system/browser better :wink:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti

Is identified as bad ^^

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Unnecessary ^^

–lee

Hi lee,

@ R= … collegiamenti…:

Why is this bad (apart from HJT-Analyzer’s saying so…) ?
What’s supposed to be the danger… ? ???

Hi lee,

@ R= … collegiamenti…:

Why is this bad (apart from HJT-Analyzer’s saying so…) ?
What’s supposed to be the danger…

The problem/danger is ‘R0’ because they are almost always Spyware, more specificly hijackers, also ‘R0’ as far as i know is a way of hiding something the the registry from the user, so when i saw R0 i went and looked for info on the web by using hijackthis analysers and general information from google search engine, and i came to the conclusion that it was indeed bad.

–lee

HijackThis doesn’t say if something is bad or not. That is for the user to find out.

Lee16,
this seems an opinion…This entry was analyzed in a Hijack forum where no exception was arised about it !

http://forums.net-integration.net/index.php?showtopic=24919

lee,
lookup the respective RegKey on your machine, and you’ll probably find “Links” as entry there

could this mean “collegamenti” in italian ? (just guessing :wink: )

collegamenti means connections.

Collegamenti means both connections and links…
in this case it means “links”

http://www.geocities.com/landolini/IE.jpg

http://www.geocities.com/landolini/HIJ.gif