first of all i wanna tank you in advantage for your support and sorry myself for my bad english. ;D
Now the problem: i got a notebook with windows xp sp2(every update done) and avast home edition updated, but when i connect my computer a popup from avast apper and say that my computer is affected by the trojan Agent.hbx[trj], then i try to clean/delete/move to trash and it seems to work fine, but every 20/30 seconds the popup appears again. I’ve tryed eveything: bootscan, adaware,spybotsd, another trojan remove software,delete all temp file with ccleaner but the popup appers again.
The files infected are(seems to be temp files that the trojan recreate so many times): C:\windwos\temp\bts3.tmp
Under Configuration and Preferences, click the Preferences button.
Then click the Scanning Control tab.
Under Scanner Options make sure the following are checked
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quaranine.
leave the others unchecked.
Return to the main page by clicking close on that screen. On the main screen, under Scan for Harmful Software click Scan your computer. On the left check C:\Fixed Drive.
Under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan.
When the scan is done, quaretine everthing found . Reboot if asked.
edited to add: update first, also disconnect from the internet.
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware (like oldman before), Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG or Panda.
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.