all those are infected with Win32:Trojan-gen [Adw] and {Other}
when i reboot my laptop in normal mode all i get is a black screen with a cursor so i open task manager and run explorer.exe in order to get the desktop to display. what can i do to repair these viruses? i heard about VRBD attempting to repair stuff in the background when the pc is idle but i don’t know if anything is happening because even when avast is active it doesn’t show an icon in the taskbar.
additionally, if those files were in it’s original locations then the icon is visible and VRBD runs and detects those rootkits but will not allow them to be deleted. i also tried boot-time scan but can only “move to chest.” i don’t know what to do now. ???
Are all these files in the “infected” area of the chest? There are four areas: Infected, system, user,and all chest files.
The infected area is the only area you should look at following a scan.
I would not be surprised if one (or more) of those is a false positive. “userinit.exe” is a system file, and perhaps you could try restoring it to see if you can then log on to Windows.
A bit of history would not go amiss. There’s not really enough info in your post so that a semi-geek like me can work it out. What prompted you to scan? That is, was there any computer behaviour that led you to think it was infected, or was it a routine scan?
How long have you had Avast installed, and what did you use prior? What other security software is installed?
Last but not least, what is the operating system?
send the files to www.virustotal.com analysis and post the results here… i believe these files are not false positives (they only have similar names to common system files)…
The detections in this location, C:\Program Files\Alwil Software\Avast4\DATA\moved are there because you previously chose the option to Move/Rename. The Moved folder isn’t in the chest so on subsequent avast scans it would find the moved/renamed (the .vir tagged on to the end) detection.
It is best to only use the Move to chest option as files in there are encrypted and protected and won’t subsequently be detected again by avast.
When posting the results from VirusTotal (VT) just post the results page URL it will save copying and pasting, etc.
To be able to upload to VT you will have to do some things because avast would block this.
Check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.
Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.