I installed avast yesterday and it seems to have found a heck of a lot of viruses and stuff that ESET NOD32 didn’t… I’m currently in the process of doing a scan and I’m getting a lot of warnings with files that are infected with Win32:Vuku [trj]. It seems they are all Temporary Internet files so I’m wondering if it would be okay to just delete them instead of putting them in the Virus Chest, which is what I’ve been doing so far.
Also, how do I get rid of this Vuku virus?
These warnings are popping up like mad! One after the other…
[quote]It seems they are all Temporary Internet files/quote]
Temporary internet files are safe to delete.
However, any files outside of that should be quarantined to make sure that they aren’t needed.
If you have avast delete a file, it’s a one-time thing. You can’t revert back after that.
It’s better to quarantine if possible, so that in case something was quarantined that was important, it could be restored if needed.
Nothing in the virus chest can harm your computer, so it’s best to put infected files in there.
As for the “vulu virus”, try running an avast boot-time scan, so that you can find all infected files
Okay. Thank you! I figured deleting them would be okay but I wanted to be sure…
Hi Cat38,
Please give us a hijackthis logfile txt attached to your next posting, download it from here: http://www.filehippo.com/download_hijackthis/download/58170ee6e58bba306c943f5b6d745c99/
I think you may not have an active firewall running,
polonus
I do have a firewall on. It’s the one that comes with the computer. For a long time I was without one though.
Avast found more Vuku. D: This time in C:/System Volume Information/restore[…]. No idea what that is…
Also having problems with another virus called Win32:Tibs-ALQ. I can’t move the files infected with this virus into the Virus Chest either.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us10.hpwis.com/ http://srch-us10.hpwis.com/ http://srch-us10.hpwis.com/ http://srch-us10.hpwis.com/ http://us10.hpwis.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://srch-us10.hpwis.com/ http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
–
Win32:Vuku is related to Virtumonde/Vundo… you should temporarilly disable the system restore (to get rid of the system_volume_information detections), use some dedicated tool for removing Vundo (even with its registry keys etc) and re-enable the system restore…
How would I temporarily disable System Restore? And what tool do you recommend I use to remove this virus?
Do you have any information on the Win32:Tibs-ALQ virus?
Try these two programs,update them,then run scans,post the results, and another HJT log.Some people disagree about disabling system restore,nothing in there can do harm unless the pc was restored to an infected restore point.
http://filehippo.com/download_malwarebytes_anti_malware/
http://filehippo.com/download_superantispyware/
system
May 10, 2009, 11:33am
10
Well… Malwarebytes Anti-Spyware has yet to finish scanning… a bit over two hours now. I didn’t think it was going to take this long. I’ll post the results when it eventually finishes and do SUPER later on and whatnot. It’s seven in the morning and I haven’t gotten any sleep.
system
May 10, 2009, 1:16pm
11
Malwarebytes’ Anti-Malware 1.36
5/10/2009 9:15:03 AM
Scan type: Full Scan (C:|D:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
system
May 10, 2009, 1:17pm
12
Files Infected:
Is it safe to remove all the infected?
system
May 10, 2009, 1:38pm
13
Let MBAM remove them and it will move the infection into the Quarantine.
Schedule a boot scan then have some sleep and let the system do that while you sleep.
system
May 10, 2009, 1:41pm
14
I don’t know if I’ll be getting any sleep today. It’s morning and there’s outside work to be done. sigh
More scanning to do!
system
May 10, 2009, 1:59pm
15
I live on the 10th floor in an appartment so no lawn to cut and leaves to rake and I have had my second cup of coffee so now I need to think about what to make for breakfast or maybe I’ll just wait until noon and I’ll have a beer while making Brunch.
system
May 10, 2009, 2:57pm
16
You can alway do a standard scan of Avast! with archives. So if a suspect is found you will see in the next day after your done of sleeping
Mr.Agent
