virus on IE startup

Viruses and worms
1

Ok every time i start of IE for my email my avast pops up and says that i have a trojan trying to get on my system here is where its at

C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\CyberDefender\stBarPat.dat

then on my
local area connection status at the bottom is says
activity and under sent it has a number that keeps going up and then received a number that keeps going up, we didnt think we seen this before so fear its part of a virus sending our info please help!

2

ok i just wanted to add it just popped up and said a trojan horse was detected but not to worry if i hit abort connection it wont download on my computer and gave this

http://download.cyberdefender.com/stbar/cdst2/stbarpat.dat.03\unp209925561

3

google finds

http://www.exterminate-it.com/malpedia/remove-SpyBlocs

cyber defender
last time we saw this TECH suggested edited by me

  1. Clean your temporary files.
    use atf cleaner or CCleaner

  2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! (http://www.freedrweb.com/cureit/) instead.

  3. Use SUPERantispyware (http://www.superantispyware.com), update quarantine do not delete/ remove

and MBAM (http://malwarebytes.org/mbam.php) to scan for spywares and trojans.
update- check baddies- click REMOVE SELECTED

If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

  1. Test your machine with anti-rootkit applications (http://www.antirootkit.com/software/index.htm).
    I suggest avast! antirootkit (http://files.avast.com/files/beta/aswar.exe) or Trend Micro RootkitBuster (http://www.trendmicro.com/download/rbuster.asp).

  2. Make a HijackThis (http://www.bleepingcomputer.com/files/hijackthis.php) log to post here or, better, submit the RunScanner (http://www.runscanner.net/) log to to on-line analysis.

  3. Immunize your system with SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html) or Windows Advanced Care (http://www.iobit.com/AdvancedWindowsCarePersonal/index.html).

  4. Check if you have insecure applications with Secunia Software Inspector (http://secunia.com/software_inspector/).

4

wow thanks for the help that is alot to do, but thanks!

5

ok i cant figure out how to turn on the archive files on avast?

6

When you schedule a Boot-time scan (I presume you have been able to do that) there is a check box, for Scan archive files, there are also Advanced Options that you can select, see image.

In on-demand Scans:
When you select what area to scan, Local Disks, Folder Select, etc, there is a check box that is for scanning archives.

Personally I don’t scan Archive (zip, rar, etc.) files are by their nature are inert, you need to extract the files and then you have to run them to be a threat. Long before that happens avast’s Standard Shield should have scanned them and before an executable is run that is scanned.

7

coander, ask for help for the steps you need. It’s good to follow all of them.

8

I posted the google hit to show what a manual removal would involve
I DO NOT SUGGEST THAT YOU TRY EXTERMINATE IT
I do hope the scanners recommended will do most of the work for us
here is a RELIABLE thread
http://forums.spybot.info/showthread.php?t=10074
so if the scanners recommend do not get your malware we know that SPYBOT Search and Destroy not only detects it but has some experience with it as well
Spybot catagorizes as a PUPS or potentially undesirable program
so ask or figure out out to make sure “detect pups” is activated if/ when you run Spybot