Rsebud945 Virus hell, part 2

According to your post http://forum.avast.com/index.php?topic=43807.msg366468#msg366468
Both files were wadv07nt, however I cannot fully see the file name on the second entry, only

C:WINDOWS\Service Pack Files\i386\wadv0 . . .

I have to go now, my advise is restore both files,UPDATE MBAM then scan.Hopefully you are clear. I cannot make myself any clearer :slight_smile:

PS if you follow my advice, and get the all clear, don’t forget to turn system restore back on.

YOU MUST UPDATE MBAM TO 1921

:slight_smile: Hi :

There are about 5 “references” to McAfee’s “Common Framework” in your
HijackThis Log and they appear to be “linked” to McAfee’s antivirus program !?
IF true, it appears you did NOT fully “remove” McAfee PRIOR to installing Avast,
which is NOT recommended . It would appear you should follow McAfee’s
Recommendations for FULLY REMOVING their program at
http://service.mcafee.com/FAQDocument.aspx?id=TS100507 . Particular emphasis
should be on using their “MCPR.exe” Tool in “Step 2, #1” .

Thanks. I used the uninstall option for the McAfee, but I will go to the link you gave me. Does that explain why I might have gotten a virus even with the avast on?

ARGH! The tech department at the college where I teach gave me a copy of McAfee Enterprise on a cd right before I wiped the hard drive, and I used it to be able to get online to buy Avast. Trouble is, they didn’t put the uninstall tool on there!

:slight_smile: Hi :

“Uninstall Application/Removal Tool” is NEVER put on an Installation CD .

As far as your “Detection” "experience, you are getting quite a “lesson” as to
WHY it is recommended to go to the Online Support Forum of the program in
question to inquire IF the “detection” might possibly be a “false-positive” .
Takes a little more time, but prevents what you are currently experiencing .

I called McAfee Tech support and they are sending the removal tool.

The cd was not an “official” installation cd. It was a cd made by the tech department at my college. Its not exactly a bootleg copy, as the school pays for the AV, but they have to make cds for students and faculty. I am not a tech person. I teach communications and writing, so just KNOWING about these removal tools and even these forums is a very new thing for me. I have had three computers in 15 years, and NEVER had problems like this until this year, when I get slammed with it all! You don’t go looking for help until you have a problem, do you?

:slight_smile: Hi :

And eventually, since your “Java” program is extremely outdated and is
therefore an extreme security risk, you should use the FREE “JavaRa” program
at http://raproducts.org . Should ONLY ever have 1 “Version/Update” of this
on a computer .

And you also have the malware-prone Adobe Reader, which I recommend be
uninstalled and “replaced” with “Foxit Reader” ; however, there was recently
a very good discussion about these 2 at
http://forum.avast.com/index.php?topic=43749.msg366004;topicseen#msg366004 . I emphasize what
Polonus says about this “topic” .

McAfee has sent me two uninstall tools and neither works. I am now on hold with the tech department while they try to figure out what to do.

This is why I have AT LEAST learned that I do not want McAfee or Norton anywhere NEAR my machine! >:(

:slight_smile: Hi :

This is a long shot, but perhaps you can convince someone in your school’s
IT Dept to have an AV program other then either Symantec/Norton or
McAfee !?

Have you tried using the McAfee “Removal Tool” from the Site I quoted !?

P.S. Another try is to use the FREE “Revo Uninstaller” from
www.revouninstaller.com .

LOL! In short, not a snowball’s chance, or maybe a snowball’s chance after MUCH deliberation lasting YEARS!

Yes, I tried that tool and a second tool that the second to the last tech support TOOL at McAfee sent me! Now they are telling me that they can’t send me another tool until I give them a grant number, which takes me back to the FABULOUS IT department at the university!

If this attempt fails, I will try your link. :wink:

Okay, I have removed all of the McAfee. Now is there anything that I should do to make the Avast work better? I have updates installed automatically.

Okay, I uninstalled the McAfee and the adobe and got foxit, and I upgraded to the JavaRa. Is there anything else that I need to do to prevent these stupid viruses from infecting my computer?

:slight_smile: Hi :

To increase your security protection, we usually recommend installing and
periodically using Malwarebytes’ Anti-Malware ( www.malwarebytes.org/mbam.php ) and/or “SUPERAntiSpyware”
( www.superantispyware.com ), both of which come in FREE Version(s) .

And you have a program called “Real Player”, which we usually recommend be
uninstalled and “replaced” with a program called “Real Alternative” with Info
at http://real-alternative.en.softonic.com/ .

I do NOT advocate the use of IObit’s “Advanced SystemCare 3”, primarily
because the company is based in mainland China and because it includes a
“registry cleaner”, which One should be extremely careful of using .
For what some experienced, certified, Volunteer “Microsoft Most Valuable
Professionals” think of “registry cleaner(s)”, read through the Info at
http://aumha.net/viewtopic.php?t=28099 .

Is the Malwarebytes AV compatible with Avast? I assume so, since we are on the avast forum.

I will make those changes and get rid of the system care! I wondered about it anyway because I still see flashes of trojandownloader and worm when it is scanning.

Hey Rosebud, remember that I said that Malwarebytes isn’t an antivirus program, it is an anti spyware / adware program. It’s perfectly safe to use with avast or most Antivirus programs…

Looks like you’re getting close to getting this all straightened out. Great job!

Thanks! I’m trying, but I do think those system restore files were infected, so I am getting trojan fatigue! LOL! My friend told me that a rootkit trojan embedded itself in her computer and even the pc guy couldn’t get it out! I hope I’m clean!

Anyway, I will get the malwarebytes, get rid of the real player and system care, and get that alternative media player. But do I need to do anything to the Avast?

Thank yall so much! I will keep you posted! :wink:

You are a fool, who does not heed advice
http://www.malwarebytes.org/forums/index.php?showtopic=13391

Your pc will malfunction at some point,now you removed system files

Sir, I did not purposely remove them as I tried multiple times to tell you. Malwarebytes removed them. They were never IN the quarantine folder for me to opt to restore! Yes, the two wadv07nt.sys files were, but not those two system restore files. Please don’t toss insults if you don’t read MY posts carefully!

The two wadv07nt.sys files are what I’m talking about.I have read your post carefully.The other two files are replicas. Windows system restore creates a copy of everything you do,in case you need to restore your pc.This includes viruses. The viruses in system restore are dangerous if your restored the pc,you could restore the virus.You only EVER had two viruses( which were not viruses,but mistaken as such ),which had identical copies made in system restore.When you turned off SR this deleted all restore points and everything in them.Am i getting through yet ? The two files in quarantine are legit files,that have mistakenly identified as malicious.MBAM staff,have admitted this and rectified the problem with an update.Are you smelling the coffee ? If you care to post on there forum they will advise you to restore the files from quaratine back to the system32 folder and to update MBAM to 1921. This is my last word on the subject,I have wasted more than enough time trying to explain this to you.
http://www.malwarebytes.org/forums/index.php?showtopic=13378&st=0&p=68914&#entry68914
::slight_smile: ::slight_smile: ::slight_smile: