On start-up Infected Memory - Pls Help !

Avast Free Antivirus / Premium Security
1

I am using the 4.60 Home version.

On star-up just after testing the memory, I get an error of infected memory. I can not go any further and then it ask me to send the error message to technical support.

When going to the log viewer, I get the following warning: Sign of “Win32:Adan-003 [Adw]” has been found in “c:\window\system\bnaq52vr.exe” file.

Thanks for your help.

2

Are you using Windows XP?
Can you schedule a boot-time scanning?
Start avast! > Right click the skin > Schedule a boot-time scanning
Select for scanning archives.
Boot.

Maybe you can solve this problem…

3

Please see my answers in bold below.

4

You can’t… :cry: Boot time scanning is only available in Windows XP.

What do you mean…? Does the skin does not appear?

5
What do you mean...? Does the skin does not appear?

originally you wrote:
Start avast! > Right click the skin > Schedule a boot-time scanning
Select for scanning archives.
Boot.

How do you right click the skin? I guess this is in XP only

6

No, the skins are available in Windows 98 too.
Run C:\Program Files\Alwil Software\Avast4\ashSimple.exe
If it does not work, try
C:\Program Files\Alwil Software\Avast4\ashSimpl2.exe

7

After I bypassed the memory scan, because the program bombs if I do not, Avast was able to start scanning, but once the scanning reach that same file :c:\window\system\bnaq52vr.exe. It bombs again.

P.S I just saw your new message.

I clicked on the exe files that you suggested (I get the Avast simple user interface) and selected test archive and thorough type of scan. But how do you Schedule a boot-time scanning. Please excuse my ignorance.

Now it is scanning and I hear several sirens indicating infected files, but it does not bomb and keeps scanning more files. I will let you know the result of the scanning.

Thanks

8

Thanks for your help Tech !

The results of the scan is 17 infected files and several hundreds of unable to scan archives because of password protection.

I isolated the 17 infected files into the chest because they could not be repaired.

I assume that I probably can delete those unless they are system files.

Can I safely delete c:\window\system\bnaq52vr.exe ?

Thanks again for your help.

9

Yes it is safe to delete files like that. Although they are in the system folder it doesn’t mean they belong to the system.

10
But how do you Schedule a boot-time scanning. Please excuse my ignorance.

Answer you can’t run a boot-time scan with win98 as Tech mentioned, this is only available in NT based Operating Systems (winNT win2k winXP, etc.)

11

But couldn’t it be a system file that was infected, and the user shouldn’t delete it until he is sure that it is not a system file? I mean, its safe in the chest, and the user should just investigate the file’s origin first before deleting it…just to be safe…

12

I’m sure we can trust Eddy, he has been a great help here for a very long time. :slight_smile:

13

Just because it is in a system folder doesn’t mean it is a system file, this is a common tactic to deceive and make people think twice about deleting the file. Check your friend google and see what results it returns for bnaq52vr.exe if it is a legitimate system file you can bet there will be information about it.

You could also move it to the chest rather than take the nuclear option of deletion as your first step. After a week or two if there has been no adverse effect it can be scanned again in the chest and if it is still flagged as a virus, delete it from within the chest.