problem with dealing with a non registered script virus

system · 2008-02-09T12:45:00.000Z

Hi there,
Can anybody help me. I have been having major problems with viruses and trojan horses. Last week I panicked and started deleting lots files when after a scan AVAST said that I had lots of these. At first I tried repairing and then moving to the safe box files but this was not allowed so i started deleting files which i thought were useless and unused. Unbeknown to me these were important start up files so eventually I had to reset my image and lost a lot of programmes which I really need and i am finding it difficult to get back.
Anyway, now the registry editor is saying that i have a file which is a non-registered script (a virus) and i cannot repair or import it to the safe box (sorry again forgot the correct name of this).
Can anybody offer me any advice on this
thanks
mh

DavidR · 2008-02-09T13:48:18.000Z

Anyway, now the registry editor is saying that i have a file which is a non-registered script (a virus) and i cannot repair or import it to the safe box (sorry again forgot the correct name of this).

I would suggest running the registry editor (which is ?) for more information as it is impossibly to speculate, well not impossible, but not with any possible accuracy.

What is your OS ?

When you get a problem as you have, where you are unable to repair (not always possible, see below) or move to the chest (usually because the file is in use), then you could try scheduling a boot-time scan. This runs before windows starts so should get round that problem and allow you to send to the chest.

If you have XP, vista32bit or Win2k, you could enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, Menu, ‘Schedule boot-time scan…’ Or see http://www.digitalred.com/avast-boot-time.php.

Repair:
Trojans generally can’t be repaired (either by the VRDB or avast virus cleaner), because the entire content of the file is malware, so it is either move to chest or delete, move to the chest being the best option (first do no harm). When a file is in the chest it can’t do any harm and you can investigate the infected warning.

The VRDB only protects certain files, mainly .exe files, it doesn’t protect data files or all files, it is not a back-up program, so there are going to be many occasions where repair won’t be an option.
Only true virus infection can be repaired, e.g. when a virus infects a file it adds a small part to it, provided that file is one that avast’s VRDB would monitor and you have run the VRDB, then it may be possible to repair the file to its uninfected state.
However, for the most part so called viruses, trojans (adware/spyware/malware, etc.) can’t be repaired because the complete content of the file is malicious.

system · 2008-02-09T18:37:56.000Z

Many thanks,
My operating system is windows 2000 so following your instructions and hopefully this will fix the problem…
cheers
mh

DavidR · 2008-02-09T19:47:16.000Z

No problem, glad I could help.

Let us know how you get on.

Welcome to the forums.

system · 2008-02-10T13:26:26.000Z

Hi all again,
well i still have the same problem.
AVAST says that I have a VBS:Malware-gen type virus/worm)
I have read lots of different sites and what they recommend but as I am very new to the area of viruses/malware etc I have as yet done nothing.
my operating system is windows 2000, i am using AVAST v4.7 and the VPS file says virus database.
once again when i try to repair or move this to the chest it states that this is a non-registry file
thanks
mh

DavidR · 2008-02-10T14:21:02.000Z

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections.

system · 2008-02-11T10:03:06.000Z

Hi there,
Firstly thanks for your help with this matter.
The file name is C:\DOCUME~1\MH\LOCALS~1\Temp\1.reg (Malware name:VBS:Malware-gen)(VPS version:080210-0)
I have used RUN %temp% and tried to delete the file from there but everytime i reboot my machine the same error message appears: WARNING A VIRUS WAS FOUND!
any advice that you can offer would be once again greatly appreciated.
thanks
mh

DavidR · 2008-02-11T14:04:56.000Z

The .reg file type is normally used to modify the registry and it may be that your registry editor is detecting that it isn’t a proper .reg file.

When you say “I have used RUN %temp% and tried to delete the file from there but everytime i reboot my machine the same error message appears: WARNING A VIRUS WAS FOUND!”
Do you mean it can’t be deleted, if so what error is displayed ?
Or do you mean it comes back to the same location ?

Did you run the avast boot-time scan as suggested and if so did avast detect 1.reg and give you options ?

system · 2008-02-12T09:53:10.000Z

Hi there,
Well the saga continues…
I have tried to delete the file from the temp folder and when this happens the programme just crashes. This morning the same AVAST warning message came up but when I have looked in the temp files the file is not there.

I have read some many different things about this on different sites and everyone seems to be giving different advice.

Once again the info is below:

C:\DOCUME~1\MH\LOCALS~1\Temp|1.reg
VBS.Malware-gen
VIRUS/WORM
080210-0

Thinking at this point of reformatting my computer but already done that about 3 times in the last 2 weeks so I know that is not really the best option.
thanks
mh

system · 2008-02-12T14:48:38.000Z

Hi there again,
think that i have finally solved the problem (fingers crossed)
installed SDfix and then superantisoftware and hopefully the problem has gone away
many thx for your help, suggestions, answers
mh

DavidR · 2008-02-12T16:11:22.000Z

Thanks for the feedback.

Glad that you have it resolved, good work.

Announcements