When results says it can't scan something called Winstart.bat what do I do?

Viruses and worms
1

Hi,
I’ve used Avast for years without any problems but lately I’ve gotten some kind of bug or malware and it’s really causing problems. I was working with one of the forums but it’s been an everday thing now for over two weeks, and scan after scan of about 6 different things and I don’t seem to be getting anywhere.
I’ve just scanned again and it says a trojan was detected, I’ll post the results, but it says it can’t scan C:\windows\winstart.bat so I right clicked and ran scan and Spybot S&D is running right now, I’ll post it if anything shows up.
When I first started using Avast I’d get a lot of the ‘can’t be scanned’ results (I’ve had to reformat and haven’t gotten one for awhil) and have never Known what to do with them. Could you please tell me why it couldn’t be scanned? I mean this one and others, what keeps it from being able to scan something and what do I do when I get that on the results?
Any help will be greatly appreciated, Thanks, Ryan

9/22/2007 6:17:05 AM SYSTEM 1516 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
9/22/2007 6:17:07 AM SYSTEM 1516 An error has occured while attempting to update. Please check the logs.
10/13/2007 1:45:36 PM SYSTEM 1324 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
10/13/2007 1:45:36 PM SYSTEM 1324 An error has occured while attempting to update. Please check the logs.
10/15/2007 6:06:23 PM SYSTEM 1332 Sign of “JS:Agent-Q [trj]” has been found in “http://mpack.redirfeed.com/mpack/mp_/index.php” file.
10/17/2007 7:06:58 PM SYSTEM 1332 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
10/17/2007 7:06:59 PM SYSTEM 1332 An error has occured while attempting to update. Please check the logs.
10/17/2007 7:25:40 PM Kat 1212 Function setifaceUpdatePackages() has failed. Return code is 0x000004C7, dwRes is 000004C7.
10/17/2007 7:34:28 PM Kat 1212 Function setifaceUpdatePackages() has failed. Return code is 0x000004C7, dwRes is 000004C7.
10/17/2007 7:43:55 PM SYSTEM 1332 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
10/17/2007 7:43:56 PM SYSTEM 1332 An error has occured while attempting to update. Please check the logs.
11/10/2007 1:23:44 PM SYSTEM 1728 Sign of “Win32:CTX” has been found in “http://acs.pandasoftware.com/activescan/as5free/motor.cab\pskavs.DLL” file.
11/10/2007 1:26:59 PM SYSTEM 1728 Sign of “Win32:CTX” has been found in “http://acs.pandasoftware.com/activescan/as5free/motor.cab\pskavs.DLL” file.
11/10/2007 1:37:57 PM SYSTEM 1696 Sign of “Win32:CTX” has been found in “http://acs.pandasoftware.com/activescan/as5free/motor.cab\pskavs.DLL” file.
11/11/2007 8:25:31 PM SYSTEM 1696 Sign of “Win32:CTX” has been found in “C:\WINDOWS\system32\ActiveScan\pskavs.dll” file.
11/12/2007 12:38:52 AM Kat 3796 Sign of “Win32:CTX” has been found in “C:\System Volume Information_restore{997EC958-CAC4-4BDE-B4EA-53754CEA85C2}\RP246\A0021882.dll” file.
11/14/2007 8:55:10 PM SYSTEM 1340 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
11/14/2007 8:55:13 PM SYSTEM 1340 An error has occured while attempting to update. Please check the logs.
11/14/2007 9:02:34 PM Kat 2152 Function setifaceUpdatePackages() has failed. Return code is 0x000004C7, dwRes is 000004C7.
11/14/2007 9:12:12 PM SYSTEM 1336 Function setifaceUpdatePackages() has failed. Return code is 0x20000004, dwRes is 20000004.
11/14/2007 9:12:13 PM SYSTEM 1336 An error has occured while attempting to update. Please check the logs.
11/18/2007 4:00:19 PM SYSTEM 1772 Function setifaceUpdatePackages() has failed. Return code is 0xC0000142, dwRes is C0000142.
11/18/2007 4:00:26 PM SYSTEM 1772 An error has occured while attempting to update. Please check the logs.
11/23/2007 3:56:53 AM Kat 660 Sign of “Win32:CTX” has been found in “C:\WINDOWS\system32\ACTIVESCAN\pskavs.dll” file.
11/26/2007 5:29:57 AM Kat 1360 Sign of “Win32:CTX” has been found in “C:\WINDOWS\system32\ActiveScan\pskavs.dll” file.

2

“C:\WINDOWS\system32\ActiveScan\pskavs.dll” file seems to be related to any online scanner that does not encrypt their signatures (maybe Panda ??? ).

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text. Files that can’t be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.

I suggest:

  1. Disable System Restore and reenable it after step 3.
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast with archive scanning turned on.
  4. Use AVG Antispyware; SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  5. Test your machine with anti-rootkit applications. I suggest AVG or Trend Micro RootkitBuster.
  6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.
3

one FP in Win32:CTX was solved already… maybe this is another case, but i can’t tell you without having seen the file… can you send it in password protected archive to virus[at]avast[dot]com and fill in “for krejdlm - Win32:CTX false”? thx

4

and cause i see the error messages about VPS updates, i should ask you for your curent VPS version…