Hi, my name is mareli and I have a problem with Avast.
Since a month ago when I scan my HD with Avast usually I find a virus called Trojan 85* (850, 851). It’s in window/system (I have still windows 98, I know!)
Every time Avast cleanes it, and the next scanning is good. Then I connect again and the virus is again on.
I’m confused. no other scanning found this virus but Avast. I run hijackthis or virus cleaner or ravantivirus on line. This virus can be found just by Avast.
Besides I can’t have any information about it. What damage could it do? It’s really a virus or what?
a) read the link “VirusRemoval” below in my sig
b) please tell us the exact virus name and the full path/folder/filename of the infected file
c) test the file with Onlinescanners (avast shield paused for this)
d) come back with above info & a hijackthis-Log & the version# of avast (program & VPS)
the path is c:windows\system
the name(s) are variable:
something like XxXxXxXx.dll (the letters change). Avast recognizes it as: Win32:trojan-850 [Trj] or Win32:trojan-851 [Trj].
Viruses are always removed but after a connection I always find them again.
I used RAV and it didn’t find anything suspicious
avast:4.6-623 (I think it’s the last update. I set the updates automatically)
this is hijackthis.log
Logfile of HijackThis v1.99.1
Scan saved at 12.55.04, on 02/04/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)
first thanx for help.
I did what you said but I couldn’t find any process named like you said or any file on the downloades under that name.
Hijackthis helped me but the problem is that even if I get rid of the infection fixing it at the next reboot the problem is here again
So I’d say that whatever I’m looking for it’s well hidden (for me! :
next time, you should MOVE the infected file to avast’s MOVED folder, NOT to the CHEST
from there, upload it to JOTTI (link : you know where ) with avast shield PAUSED
come back with the list of scan results
(remember to reenable the Shield afterwards… )
P.S. its probably a DIALER, so you should check your next phone bill carefully, and maybe keep the file in the moved folder, if you want to argue the phone bill
you can get “infected” by a dialer, i.e. it can be secretly installed on your PC, whether you’re on ADSL or modem, doesn’t matter:
just by surfing with unsafe system/browser settings to spurious sites
it can just do you no harm (not increase your phone bill) with ADSL …
(IF you don’t keep an analog/dial-up modem in the PC, e.g. for fax purposes or so…)
But this finding of the dialer means that other malware (e.g. trojans, spyware…) can also enter your system this way and do you lots more harm, until you’ve secured it…
