Hello
When i do a scan Avast always find between 3 and 6 files infected.
I choose to remove, but when i restart windows XP (sp3) and i do a new scan the same result :
between 3 and 6 files infected (the same).
Crypt-HMZ[Troj]" & "MalOb-BZ[Cryp] (.exe)
I tried to do in window XP without failure but infected files always here …
What can i do ?
Thanks
Hello ginkos and welcome to the forum. 
What is your OS (32 or 64-bit)?
What version of Avast do you have and what product (Free, Pro, or AIS)?
Was this a Full Avast scan you did? The last 3 are just system restore, so don’t worry about them. However is everything from your screen shot in the Virus Chest?
What is your OS (32 or 64-bit)?
What version of Avast do you have and what product (Free, Pro, or AIS)?
I also recommend you clean up your machine next with CCleaner Slim version, which you can download here: http://www.piriform.com/ccleaner/builds - scroll down to the 4th choice. It removes unused files (cache, temporary Internet files, etc.) from your system allowing Windows to run faster and freeing up valuable hard disk space. It also cleans traces of your online activities such as your Internet history.
Then download TFC by OldTimer to your desktop.
http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/
· Please double-click TFC.exe to run it. (Note: If you are running on Vista or Win7, right-click on the file and choose Run As Administrator).
· It will close all programs when running, so make sure you have saved all your work before you begin.
· Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
· Once it’s finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.
After the cleaning process above and rebooting, then you are ready to download and run MBAM (Malwarebytes’ Anti-Malware to check for malware:
· Download free http://www.malwarebytes.org/ for an on-demand scanner.
· Double Click mbam-setup.exe to install the application.
· After install, click update so you have latest database before scanning.
· Under Settings:
o General: Automatically Save File After Scan Completes is checked off
o Scanner Settings: Check all boxes
o Updater: Download and install update if available is checked off
· Once the program has loaded, select “Perform FULL Scan”, then click Scan.
· The scan may take some time to finish, so please be patient.
· When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
· Click the “remove selected” button to quarantine anything found. You will find the infection details under the Quarantine tab.
· The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
· Copy & Paste the entire report in your next reply.
Please let me know if you have any questions. Thank you.
Hello
Thank you :
What is your OS (32 or 64-bit)?
==> 32 bit
What version of Avast do you have and what product (Free, Pro, or AIS)?
==> Free (up to date)
Was this a Full Avast scan you did? The last 3 are just system restore, so don’t worry about them. However is everything from your screen shot in the Virus Chest?
==> I did simple scan and depht scan :The result is always the same :
between 3 and 6 infected files :I choose “delete definitively” but when i restard windows and i’m doing a new scan : Avast steel find the same infected files…
==> I already have Ccleaner and i already did cleanup but no result
==>==> i will install Malwarebytes and report here soon
Thank you
You need to update Avast again, run a FULL scan, but this time do NOT delete…you need to put the items infected into quarantine so they stay in the Virus Chest. You want to KEEP them safely in the Virus Chest for now; they are safe there. Avast may be finding the infected files until we take care of your System Restore, but I want to see your MBAM log first.
After doing your MBAM scan, please copy and paste your MBAM log for me to review. Make sure if any infection comes up during the scan, that you put it into quarantine.
Let me know if you have any questions. Thank you.
Thank you i did scan with malwarebytes and he find 2 infected files i deleted them, the logs are :
==============Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4052
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702
15/09/2010 19:59:40
mbam-log-2010-09-15 (19-59-40).txt
Type d’examen: Examen rapide
Elément(s) analysé(s): 111618
Temps écoulé: 12 minute(s), 43 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
===============
Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org
Version de la base de données: 4052
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
16/09/2010 19:39:21
mbam-log-2010-09-16 (19-39-21).txt
Type d’examen: Examen complet (C:|D:|)
Elément(s) analysé(s): 178395
Temps écoulé: 57 minute(s), 16 seconde(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
(Aucun élément nuisible détecté)
after this the scan show 0 virus/malware
Malwarebyte seem to delete the virus because he find nothing and avast scan dont find anything no infected file…But :
I have another problem:i can not install new software on my PC with XP SP3 error I can not create temporary file.
So I changed the environment variable temp file but this did not change the directory is always read-only.
So I thought it came from the antivirus, so I deleted and reinstalled from a setup file that I already had.
But after installing Avast can not start, when I look in service and I try to start it by hand I have the error:
Error 1068 the service or group failed to start dependency.
http://ups.imagup.com/ano1/1285345282.impossibledemarJPG
I did another scan whith AVP tool on usb key (because i can not install anything on the hard drive c )and he find nothing else
Is this a virus? I spent malwarebytes without matches.
I never sow a windows system in with the hard drive is blocked on read only … I think is a virus conséquences but i don’t know what can i do now … I can’t reinstall windows XP cause it a netbook without CD player …
For you it a virus or a windows bug or maybe a sequele of all the scan with anti virus or anti malware ?
thanks
Thank you
You are unable to install anything at this point?
Can you turn on Windows Defender (the Windows antivirus) if Avast is not working? You will need to update the definitions and change it to Resident (on all the time) if Avast is not working so that you have antivirus protection.
I think your problems are related to malware and because malware may have caused changes in your system. I am going to refer you to our Certified Malware Removal expert named Essexboy. He will contact you here in this thread, so keep checking the thread for his post. He will give you instructions on things to do and post.
Check the information on the first post of this thread under Virus/Worms for you to check your machine for malware: http://forum.avast.com/index.php?topic=53253.0.
If you are able to download, follow the directions of obtaining the OTL logs. Post the two (2) OTL log as an attachment (Additional Options > Attach > Browse (the logs will be on your desktop > Post). If you are unable to do this, then just wait for Essexboy to help you.
In the meantime, do not make any changes to your machine other than what I stated above. I will still be here to assist you. Let me know if you have any questions. Thank you.
C: \ Program Files \ DaemonTools_WhenUSave_Installer \ DaemonTools_WhenUSave_Installer.exe (Adware.WhenU) → Delete on reboot.
This was addware auto-checked when you installed DaemonTools. For more information, go here:
http://answers.yahoo.com/question/index?qid=20071130175309AAKfzJR
The Wot scorecard:
http://www.mywot.com/en/scorecard/daemon-tools.cc
C: \ Program Files \ SagePaie \ pmswd32b.dll (Trojan.BHO) → Delete on reboot.
I can’t find anything about that. 
C: \ Documents and Settings \ PMN \ oashdihasidhasuidhiasdhiashdiuasdhasd (Malware.Trace) → Quarantined and deleted successfully.
Malwarebytes has a topic on that:
http://forums.malwarebytes.org/index.php?showtopic=22953
English MBAM Log Below.
@ ginkos,
Could you please answer and respond to my last post. I have sent a message to Essexboy and I need to know if you are able to download anything (like OTL to make a log).
Did you turn on Windows Defender in the meantime (see my last post)? Let me know if you have any questions. Thank you.
Thank you Donovansrb10 for your helpful information.
Big Thanks!
It s strange but i can download OTL.exe by rename in OTL.jpg and i can run it after on my pc !
But nothing was found :
And Avast can not start, the microsoft anti virus can not install the same problem with all antivirus:
There should be two (2) OTL logs, and I only see one log. Do you have another log somewhere?
Also, since Avast is not working, did you turn on Windows Defender (WD) and update the definitions and make it Resident – you NEED an antivirus!
I will have Essexboy look at your OTL log. Thank you.
Hi lets jump in with the big boys first I feel - we will look at OTL later
Please read carefully and follow these steps.
[*]Download TDSSKiller and save it to your Desktop.
[*]Extract its contents to your desktop.
[*]Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerMain.png
[*]If an infected file is detected, the default action will be Cure, click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerMal-1.png
[*]If a suspicious file is detected, the default action will be Skip, click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerSuspicious.png
[*]It may ask you to reboot the computer to complete the process. Click on Reboot Now.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerCompleted.png
[*]If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
[*]If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of “TDSSKiller.[Version][Date][Time]_log.txt”. Please copy and paste the contents of that file here.
THEN
Download ComboFix from one of these locations:
* IMPORTANT !!! Save ComboFix.exe to your Desktop
[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
[*]Double click on ComboFix.exe & follow the prompts.
[*]As part of it’s process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it’s strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
[*]Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
thanks a lot for all your help but i can not execute like many ohter downwload tools … :
maybee malware defender bug my windows because he always ask me autorisation to execute something…
I thinks its a windows bug and not a virus …
http://uploads.imagup.com/15/1285957793.JPG
I will format c: soon
thank again
OK that was not promising - this is a .com programme so if you use Firefox right click and select save as
Download OTS to your Desktop and double-click on it to run it
[*]Make sure you close all other programs and don’t use the PC while the scan runs.
[*]Select All Users
[*]Under additional scans select the following
Reg - NetSvcs
Reg - Shell Spawning
Evnt - EventViewer Logs (Last 10 Errors)
File - Lop Check
File - Purity Scan
[*]Now click the Run Scan button on the toolbar. Make sure not to use the PC while the program is running or it will freeze.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Please attach the log in your next post.
After delete malware defender i can executre tdskiller :
=================
And and dont know why, but after this I was able to properly remove avast and i decide to install another antivirus (Gdata).
And he find something in c:\System Volume Information sorry but i dont where i can find this log …
After delete it my pc seems normal i can doing defragmentation for exemple …
Just my windows looking slower maybe its gdata who slow down my notebook …
Tkank angain i dont know if i’d better to stay with gdata or if i reinstall avast …
Hi ginkos,
Essexboy is not done working with you yet. He still has a LOT of work to do with you. I would have held off on installing a different antivirus. He also needs to do a lot of removal of tools he installed on your machine, then add things for you on your machine. Please do not make any additional changes to your machine unless Essexboy instructs you to. OK? Thank you.
GDATA uses that Avast engine ;D
Could you run the OTS scan so that I can see what remains