Win32:Delf-MZG and Win32:Zbot-MKK

Viruses and worms
21

skibumm 100,
If that doesn’t work (and it may not, because the out of date and corrupt Avast VPS blocks the installation of the dialer, because it still thinks it is malware - what catch22!), try (on a clean/working computer) going to this page and downloading the VPS to a flash drive. (~30Mb)
Once you get home, to the sick computer, look in “C:\Program Files\Alwil Software\Avast4\DATA” and there will be a ~30Mb “VPS” file there. Replace it with the one you downloaded, by transferring the “vpsupd.exe” file from the flash drive to your desktop, then running it.

Once that has been successful, rescan the files in quarantine, when they scan clean, select “restore” for each file.

22

I can view some of the logs and alerts, there is a lot of data there. service pack uninstall folder contents missing, system32\dllcache files missing, and more… all this has been repaired, did that last night… did not need service pack uninstall anyway. The OS runs fine, for now due to drive size going to leave it as is. No need to defrag, 1%.

Repaired Avast through add remove programs, chest will not open.
scf.exe /scannow, system files repaired/restored, chest will not open.
VMWare xp sp2 OS, compared services to fresh install, nothing wrong, chest will not open

My problem stems from AV program update on 12-2-09 and the signature update on 12-3-09.

All data created by programs is already in safe place, has been. It is the function of all the programs that is at issue.

Was looking around and there is a file named index.xml in the chest folder which contains ZERO bytes of data. Installed avast on virtual OS to check same file. This file appears to contain the path/file name information that I need, in this file the data shows data for 3 system files, here is one…

00000003
1091595408
wsock32.dll
C:\WINDOWS\system32

System
1260338322
22528

If this file is empty, will the chest open? Will check that and post.

If this is the only file containing this kind of information then it is over and a manual repair is in order. Hope coffee stays warm. And thank you MKIS for all your help. Still waiting on a couple of things before I call it a day… If I find anything relevant I will post it here.

                            The past is... and can not be changed. The future, can be all that you want it to be...

OK… what I have done is go into the chest after booting up from a live cd and deleting the contents of index.xml in my virtual OS with the following results… see attached photo. This is the error message I receive when trying to access my virus chest.

This seems to me a point of no return, do not pass go, etc… Why It happened I do not know yet.

23

Check that your RPC (remote procedure call) is started and set to automatic.

Try the suggestion I posted above.

24

Tarq57

not sure if this is addressed to me… seems to be.

rpc is on and set to auto

nothing works… index.xml in the chest folder is 0kb in size, with out this data restoration is impossible. In my opinion this data should be saved under all circumstances… mission critical stuff… if it was backed up i would not be having this problem. and yes if i backed up my system… 18.5gb of it, this could of been avoided. just a bad situation for everyone…