My avast has gone crazy!!

Viruses and worms
1

My avast seems to have gone stir crazy. It has been for the past hour apparently detecting trojans and malware threats and deleting/moving hundreds of files, some of which I am sure it is not supposed to be moving! I now can’t open adobe acrobat, tray applications, picture manager and a number of other programs. Reinstallation of these programs does not work - I get told there are missing files or installation is already running. I am getting repeated warning messages from these programs which will not go from my screen.
I have run Super antispyware and Spybot search and destroy and Malwarebytes anti malware with no obvious results

I am wondering if I have some sort of virus which has attached itself to avast to make it do this. I went briefly into firefox earlier ( I normally use Google Chrome) and this was when the problems started. I operate Windows XP

I tried copying the virus chest list from avast but it wont let me. The viruses it is alleging are VBS:ExeDropper.gen and Win32:Ramnit-C

Please let me know if you need any further information and advise me of how I can access this

Thank you in advance for any assistance you may be able to offer

2

can you post any log with related content to your issues? (just attach it/them to your next post, no need to copy/paste)

C:\ProgramData\Alwil Software\Avast5\log

ps: or/and screen shots of Avast alerts about infections.

3

PE_RAMNIT.A (Trend Micro)

Worm:Win32/Ramnit.A (Microsoft)

4

I have just had one of those on another forum and Dr Web did a nice job on it

Download Dr.Web CureIt to the desktop.

[*]Doubleclick the drweb-cureit.exe file, then on Start and allow to run the express scan
[*]This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
[*]Once the short scan has finished, chose the Complete Scan.
[*]Select all drives. A red dot shows which drives have been chosen.
[*]Click the green arrow
http://perplexus.geekstogo.com/drweb_green_arrow.jpg
at the right, and the scan will start.
[*]Click ‘Yes to all’ if it asks if you want to cure/move the file.
[*]When the scan has finished, look and see if you can click the following icon next to the files found:

http://perplexus.geekstogo.com/drweb_check.gif

[*]If so, click it and then click the next icon right below and select Move incurable as you’ll see in next image:

http://perplexus.geekstogo.com/drweb_move.gif

[*]This will move it to the %userprofile%\DoctorWeb\quarantine-folder if it can’t be cured. (this in case if we need samples)
[*]After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
[*]Save the report to your desktop. The report will be called DrWeb.csv
[*]Close Dr.Web Cureit.
[*]Reboot your computer to allow files that were in use to be moved/deleted during reboot.
[*]After reboot, post the contents of the log from Dr.Web you saved previously in your next reply along with a new OTL log.

NOTE: During the scan, a pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.

5

Hi - have tried to open this file by using run and it tells me the location is unavailable.I can’t do a screenshot because the picture manager wont open to let me attach/post it

6

Thank you but what do I do with this information?

7

Thank you but the downloaded file refuses to open - it says I need an updated version of windows!! Google chrome has started telling me too that I need windows XP - ermm I have that!

8

POR FAVOR URGENTE AYUDA, HACE SEMANAS QUE NO PUEDO ACTUALIZAR MI AVAST ESTOY EN PELIGRO Y EN MI OTRA PC LE PUSE AVAST 4 PERO ME DICE QUE EL PAQUETE ESTA DAÑADO, NO SE QUE PASA PORQUE??? QUE ES LO QUE IMPIDE QUE DESCARGUEN LAS ACTUALUZACIONES SOSSSSSSSSSS
TENGO XP

9

Por favor, inicie su nuevo tema propio, ya que esto no está relacionado con un secuestro en cuenta.

Please start your own new topic, as this is not related an considered hijacking. 


Probablemente sería mejor usar la sección española de los foros, http://forum.avast.com/index.php?board=25.0
Haga clic en el botón Nuevo Tema e iniciar el nuevo tema.

It would probably be best to use the Spanish section of the forums, http://forum.avast.com/index.php?board=25.0
Click the New Topic button and start the new topic.

10

Download and burn Dr. Web LiveCD using ISO Burner from a non-infected computer to a CD.

11

Yep sounds good ;D

12

i had the same prob in the past,infected by win32 hidrag,avg went crazy it was detecting like 10 viruses PER SEC!it’s really annoyin >:(

13

Link for live cd http://www.freedrweb.com/livecd/

14

I am really sorry to be so dumb, but I am not sure how do to this. Am now on daughter’s pc and have downloaded the burner but when I click on the link for Dr Web, all I get is this

Name Size Date Modified
[parent directory]
LiveCD-5.0.3-en.pdf 1213 kB 03/02/2010 23:00:00
LiveCD-5.0.3-ru.pdf 1229 kB 03/02/2010 23:00:00
md5sum 59 B 20/09/2010 23:13:00
minDrWebLiveCD-5.0.3.iso 134 MB 20/09/2010 23:09:00

15

minDrWebLiveCD-5.0.3.iso 134 MB 20/09/2010 23:09:00
This is the one to download

16

Thank you - downloading it now

17

And am now getting a burning error. It’s really not my day is it?

It’s done it now - sorry for the unneeded message

18

I am really sorry to be such a nuisance, but I have inserted the burned cd into the infected pc and cannot see how to open it; all I am getting is a file named boot and autoplay option does not work, and there is not a file enabling me to click to launch the scanner

19

You have to put the CD in the optical drive and reboot. You also have to enter the BIOS and change the Boot order, so that the first boot drive is the optical drive.

20

I’m sorry, I don’t have a clue what this means. I only have one disc drive? And where do I find the BIOS?