Ran avast on "dirty" system--problems.

Avast Free Antivirus / Premium Security
1

OK, I need some advice after installing the latest home version last night. My system was/is badly infested (I have had no security to speak of) and I was trying to do something about it. This is going to be a bit of an earfull so please be patient with me.

After install I let it run the boot time scan, and there were a bunch of things it couldn’t fix. I had no idea what to do, so at first I was deleting them–did this to a bunch of files in places like temp or temporary internet files.

When it started in with the windows directory I started moving them instead, but eventually I decided to exit since it was taking for ever and I had no idea what I was doing.

After, it started up ok with one strange message.

Then, with avast running, it alerts me to more problems, which I move.

After a while I start getting cascading ie windows–lots of them–they all say “surf sidekick” I think. This is an old problem that seemed to go away after I had rigged ie so it can’t connect to the internet (use firefox). ad-aware had not helped.

Anyway, I decide to go into add/remove programs and see if I can do something about surf sidekick.

As soon as I click the add/remove… icon I start getting a lot of alerts from avast at the same time as way to many ie windows opening. I keep clicking move to chest in avast, and eventually stop the ie windows by using “end process tree” in task manager.

THE RESULT IS UNDER THIS TEXT

After this I have big problems with the system. Left clicking on the start menu icon does nothing and most of my programs are completely inaccessible, and the desktop is acting strangely with programs and files showing mismatched icons. Task manger shows about 35 processes–which I think is a record low for my system. However, no more ie popups.

I think in trying to repair the system I must have removed something I need. The Avast virus chest shows a few system files. kernel32.dll, winstock.dll,wsock.dll, and a bunch of infected files, mostly .exe

I can’t find any guidance in the help file or these forums for problems like this. I need to know if I should try restoring files from the chest? Which ones? or restart the PC or what?

I don’t want to have to start from scratch with the system if I don’t have to.

Can anyone help? Please.

2

Trojan and malware behavior :cry:
Antispyware applications (freeware): download, install, update and run it.
Ad-Aware
Spybot Search and Destroy
Spywareblaster
A-squared
Ewido
Webroot Spy Sweeper:
Microsoft AntiSpyware
X-Cleaner Free

For antiTrojans see the sharewares bellow (download, install, update and run it, you can test it for some days):
TrojanHunter
TDS-3

Right now, do not restore nothing… The three system files are there for backup (probably not infected, see the section of the Chest at left).

Clean your temporary files and Internet cache.
Then schedule a boot-time scanning again.

Hope this helps…

3

heres what you do :

  1. Download Ad-Aware: http://www.lavasoft.de/support/download
  2. Download SpyBot: http://www.safer-networking.org/index.php?lang=en&page=download
    3.Download MIcrosoft AntiSpyware : http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en
    4.update Avast, Ad-Aware, SpyBot, MIcrosoft AntiSpyware.
  3. go to safemode “Press F8 on Boot”
    6.Scan The Whole Computer WIth Avast
    7.then Scan With MIcrosoft AntiSpyware
  4. Then Ad-Aware
  5. and finnaly with SpyBot
  6. Restart computer
  7. Run “Chkdisk” with “recovery of bad sectors”
    12.finnaly restart again

Now all the “infected” programs are gone and you will also have protection

4

You fail to tell us what OS version you are using, probably XP but what SP 1, 2, original?
You should ensure that your OS is fully up to date including IE (even if you don’t use it) as it is an integral part of the OS.

Are you using a firewall?

Also useful as a diagnostic tool - Download HiJackThis.zip - HJT Information HiJackThis Tutorial 1 or HiJackThis Tutorial 2
For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.

5

Here is an update

Things are better after running several scans. One of the anti-adware programs was able to fix my desktop–I ran all of those.

Also restarted in safe mode and scanned again with everything that would work in safe mode.

After that scans are still finding things though–I guess so far some of my problems are still able to regenerate themselves.

Soon I will run another boot time scan with avast, and try hijack this after that.

Thanks for all the help!

6
Are you using a firewall?
If not you are fighting an uphill battle, what is on your system could well be downloading more of the same, giving the impression of they are regenerating themselves.

Hijackthis is the tool to show what is running on your system, giving a chance to remove it.