Hi, I’ve got some serious issues and I can’t fix them alone.
I’ll tell you everything so far;
-Yesterday I ran a full system scan, I do this every week usually on a Monday but this week I did it on the Wednesday, and when it was finished it told me it had found a Trojan-gen in a file I think was called “report.exe” in my folder C:\windows\configsetroot$oem$$1\Apps, when I tried to move it to chest and I was told that it was unable to do so.
-I did some investigated and when I tried to Right Click>Properties on the file the little Avast red pop up saying it had stopped access come up in my bottom right hand corner and the file changes it’s name from “report.exe” to “trzEE31.tmp”, I scanned again and Avast still only found this file however when I tried to Right Click>Properties on another file in that folder the same thing happened wherein the file changed it’s name from whatever it was to “trzE434.tmp” so this one hid itself away from Avast and I only found it by looking. Avast had the blue popup in the bottom right hand corner telling me it had a new update available, I thought I shouldn’t really go updating it when I’m infected.
-By this time I had been trying to figure out what to do for an hour, it was 1AM and I was too tired to think, so I set Avast to do a boot time scan and went to shutdown so I could try to fix this in the morning, today, however Windows apparently had updates it needed to do and I didn’t really want updates trying to happen while I knew I was infected so I just turned everything off by the switches and went to bed.
-I turned on my computer today and Avast ran it’s boottime scan, it found the “report.exe” file fairly quickly and when I tried to move it to chest I was told “Move to chest: Error 0XC000007B {Bad Image}” and when I tried to delete the file I was told “Delete: Error 0xc0000034 {Object Name not found}” this made sense as I thought if the file changed it’s name yesterday then it’s hiding with this name and all that so I clicked ignore and the scan continued. A little while later in the scan it found an infected file “C:\users[My name]\downloads\flvmplayer.exe|>nsis.hdr is infected by NSIS:solimba-B [PUP]” when I tried to send to chest and then to delete I got those same two errors I had received previously. After then finding some corrupt files in my steam folder which I doubt really matter, Avast found the file “C:\windows\configsetroot$oem$$1\Apps\trzEE31.tmp” which I thought was strange since it already found it under the name “report.exe”? I tried to move to chest, no luck, however delete worked this time.
-After the scan was over I tried to log in, the screen went black and I got the “This copy of Windows 7 is not genuine” message in the bottom right hand corner, this scared me a little because my Windows 7 is genuine and I didn’t know whether I could even get into the computer now however after about half a minute my computer loaded up. I opened Task Manager straight away and looked for anything suspicious, Windows went on to automatically update itself, I assume with what I wouldn’t let it last night?, and then a popup telling me that Windows needed to restart come up which I have postponed, I then opened Chrome and signed up for this forum and posted this.
I don’t know how many of these trz.tmp files there are, as Avast only found one hidden and I only found one other myself, I don’t know if this “flvmplayer.exe” file is the cause or if it even has anything to do with this? I don’t recognise it or remember downloading it… I’m not even sure what it is and I can’t find it in my downloads folder unless I am missing it or something…
