Hello!
I was downloading and avast got a virus coming through my pc!I have stoped imediatly downloading and i have done a scan to my files …the results was 1 file with this varius thekeys [1]
Avast informe me that it put it in to the chest…
Now what i have to do with it?Live it there?Delete it? is my pc ok now that avast put it in the chest??please answer to me because i can not go to sleep i am very sad! 
thank you in advance!
In order to help fully we need more information…
- What Operating System are you using ? is it up to date ?
- What avast! version and VPS file (virus database) number, e.g. 0630-2 (see about avast!) ?
- What is the Virus name, the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
How were you downloading this, Download manager, P2P program, Instant Messenger, etc. ?
What I find strange about this is that you were downloading a file, etc., first the resident scanners (web shield, Instant Messenger ot P2P shield) should really have intercepted this before it arrived on your system.
You have done the right thing, ‘first do no harm’ don’t delete, send virus to the chest and investigate, as you are now doing.
There is no rush to delete anything from the chest, a protected area where it can do no harm (so you can sleep sound). Anything that you send to the chest you should leave there for a week or two. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.
Dear David,
thank you for your promt response!I think we have talked again from the past …i had problems with my avast i havent the avast icon down on the right of my pc and you have helped me download the home edition!
I was trying to get a key from a site i realy dont know now the site to tell you everything happend so quik!i have closed everything and now i dont know to tell you from were i’got it!thats the first thing!
second many times when i go to my chest i seen all the time a name of a virus i delete it but it is still showing up!and when i restart my pc it is again in to my chest!
now as about today avast i have is home eddition 4.7… VPS 0642-0
yes it is up to date because it is about a month i have download it!
and i will write to you exacle what i see in my chest
thekeys[1].htm c:\Documents and Settings\pc\Local Settings\Temporary Internet Files\Content.IE5\W96JWDEZ
i think i have answered to you what you need to help me! thank you again!!! 
I think that you should be OK from this particular detection. There are a few things that may help, if not for now, but in the future too.
The file/page in the chest should also give you the malware/virus name or right click the avast icon, select ‘avast! Log Viewer’ and check the Warning section, that also contains information on the detection.
I was trying to get a key from a siteWhat key were you trying to get and why ?
What surprised me is this wasn’t detected by the Web Shield provider as it should be able to detect everything that the Standard Shield can.
Is the Web Shield running ?
This should have in theory stopped it before it ended up in the Temporary Internet files, so I want to ensure it is working correctly.
You didn’t say what your Operating System is ?
As a precautionary measure you should clear the Temporary Internet files, from IE, Tools, Internet Options, General tab, Delete files, see image.
Besides what David said (Clean your temporary files), if a virus is replicant (coming and coming again), you should:
- Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405
- Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.
- Use a-squared, Free AVG Antispyware, SUPERantispyware or Spyware Terminator (trojan removers).
Hope this helps.
I will try to explain to you David about a shield i saw avast alarm and at the right down point on my pc a shield was there and a message came from it for deep scan so i click on it and took me at a page to download a programm i didnt whant to put another programm exept avast and i closed it!i do not know much thats why many times i mess up things!yes i saw a shield but i didnt know what to do…this moment that shield is not as an icon on the right down of my pc…it suposet to be there?
as about the key i have bought latley a programm for capturing video i like making films! from where i bought it i gave lot of money to buy keys for it i have unlocked the 60% of it!a friend of mine told me that in the net i can find keys for free!so i try to find them!i found a page and i start downloading!and i dindt received the key but a virus!!!
{The file/page in the chest should also give you the malware/virus name or right click the avast icon, select ‘avast! Log Viewer’ and check the Warning section, that also contains information on the detection} i dont understand this!
OOOOOOOOOO no!!! NOW THA I AM WRITING TO YOU!!! Alarm aVAST
Avast told me got another virus!!!
win32 something!!!how that can happend that i am only in this site?
how may i send a prive it msg?
Tech why i have to do this?
- Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405
Well lets deal with this in steps.
-
You would appear to have a malicious piece of rogueware, a program trying to trick you to visit a web site for a deep scan don’t ever click them.
-
There are many caught by supposed free key generators or cracked keys, since what you are doing is of a dubious nature and may be illegal you are hardly going to report it so it is a hunting ground for Trojans.
-
Web pages like avast.com don’t have malicious content, that is not to say that something on your system isn’t trying to download something and that is being caught.
-
because you don’t give us any information about the detection, virus name, location (either hard disk or internet URL) we can say what is going on or which of the avast providers that detected it. Nor can we offer advice without information virtually every malware name begins with win32 something so it doesn’t help much. I appreciate that when all hell breaks loose it is difficult to remain calm and collect information, but in the long run it will be quicker.
-
We ask questions to help identify a problem and give detailed advice, without answers to questions asked once or more, we are in the dark, it is difficult to give advice and your are frustrated.
Is the Web Shield running ? This should have in theory stopped it before it ended up in the Temporary Internet files, so I want to ensure it is working correctly.You didn’t say what your Operating System is ?
david how can i send you privet msg i want to ask you something but not her!
I relay want to give you all the information that you need to help me but i think i am not able to understand what you are asking me
see thats maby the problem that i do not understand very well english!and i am not so good at pc’s!!!i am Belive me i am doing my best!
but please tell me how can i send you a privet msg?
in my chest this moment are this:
kernel32.dll C:\Windows\system32
thekeys[1].htm c:\Documents and Settings\pc\Local Settings\Temporary Internet Files\Content.IE5\W96JWDEZ
winsock32.dll C:\Windows\system32
wsock32.dll C:\Windows\system32
kernel32 winsock and wsock32 the have an icon like a page but thekeys have a skull!!!
what operating system you are asking me to give you?where can i find it?
You can’t the PM function is currently not supported after the spamming attack recently, also private communication doesn’t allow other with similar problems to benefit from any answers.
ok i understand about msging!
thank you…
i was wondering if you can see tha damage from where you are…i meen through internet yo check my pc that is was i wanted to ask you and help me fix my problem.
please if it possible of you to tell me what you need from me and i will try to do it so i can get out this vuris i have in to my chest!
Your operating system is ‘what version of Windows are you using’ from the contents of the chest which you posted I can now see that you are using Windows XP.
The avast chest is made up of different sections, the System Files contains backup copies of important system files, they are used to recover if a virus infects the original. So these are no problem.
The Infected Files are where any infected files detected are placed and the one you gave earlier and should also give the virus name see image example sorry it is in English.
thekeys[1].htm c:\Documents and Settings\pc\Local Settings\Temporary Internet Files\Content.IE5\W96JWDEZ
Because this file was detected on your hard disk by the standard shield provider, then it wasn’t intercepted by the web shield provider like I would have expected, this is why I keep asking if it is working/enabled. The operating system (Windows version) plays an important part in how this works.
Left (double) click on the avast icon, that should open the on-access providers window, select the Web Shield icon and it should show a Last Scanned: and Scanned Count: field these should contain something and the count should be greater than 0 if it is working, See image 2.
Reference your last post:
The virus in the chest isn’t a problem, it can do no harm there, I’m concerned that there may be other problems, web shield not working and possibly something undetected on your system.
I can’t do a remote connection to attempt a fix/check of your system.
Hi Paulina :
Other than Avast, what other security programs do you
have on your computer ?
Spirtisong thank you for your concern! i relay apriciate you all fro your help!
i do not have anything else on my pc only avast!is that bad or good?
David i will start answering one by one your questions:
I saw it after i have send you the post tha name of the virus i thought the name of it was in the beginig but it is at the end so the name of it is VSB:Malware(Script) i have a question her is this virus very bad?is my C:\ have a problem? I must delete it???i do not feel comftuble having him there…you know what i meen.
Now again i am only at your site nothing else open and avast is worning me that something bad is trying to come in to my pc!since yesterday i never had this problem from the moment i’ve got the virus avast is ringing and informing me for win32 my brother was here when avast start ringing and he sead to me that it is dilers that is trying to be conect…i didnt understand much!but i think the virus that i already have is doing this problem!!!
i went and delete all the cookies and all the temporary files!
and i also went and check the site that Tech tols me this
http://support.microsoft.com/default.aspx?scid=kb;[LN];310405 but i dont realisid why i suposet to do this…i asked Tech but he is not on line to see it…do you know why i must do this?
Now i am trying to find out where is avast shield the 2nd icon you have saw to me!but i double clik to avast icon on my desk top and it is opening the program i can not find the shiled!i found the windows sield and evrything seems to be ok in there everything are activate!i will go and do an update to my windows mabe that help also i have never done an update! where i must clik to find that avast shield?maby home edition dosent have it?
It will be much easier if you can see my pc by internet…it is dificult for me believe me i am reading many times your post so i may understand what i suposed to do and answer !i am sorry if i am making you feel tierd!!!
[The virus in the chest isn’t a problem, it can do no harm there, I’m concerned that there may be other problems, web shield not working and possibly something undetected on your system.] How can i see if i have a problem in the sield?because as i told you i went into the sield and everything seems ok…maby i have to check some were else?
thank you very much!!!
i am still here whating for an ansewer and avast poped again telling me about a bad virus trying to get in my pc and her is exacly what it was writting!
http//d.mettere.net/a412/a571.php?m=1&c=5
win32:klone-N[Trij]
Trojan Horse (i dont know if this is write it is in greek and i am doing exac transelate!)
VPS 0642-2 18/10/2006
it is the 3d thime that is happening today!since i’ve got the other virus!