Win32:Zlob Virus found/cleaned but when scanning computer automatically restarts

system · 2007-04-02T22:07:38.000Z

I just downloaded Avast and installed it this morning and did a boot time scan which found a couple viruses and cleaned them. Apparently after the computer was booted up and running Avast found traces of the virus in the windows restore files and quarantined them. I then attempted to do another scan just to make sure and the computer automatically restarted itself. Just BAM! then it was booting back up. It is doing that consistantly when I try to scan the windows directory. I am getting frustrated and I don’t know why it’s happening. ??? Any help would be greatly appreciated!!

Thanks

system · 2007-04-02T22:50:48.000Z

OK I went and turned off system restore and also unchecked the check box for an automatic system restart on system failure so the next time I got the blue screen with text on it. The second time I tried no blue screen just the horrid “windows has performed an illegal operation” etc. notice. I’m really getting frustrated here because this is just stupid and shouldn’t be happening. I’m starting to think I may have to uninstall Avast since it seems to be what’s crashing everything now that the virus(es) "seem to be gone. Of course having already tried installing Prevx and Norton missing the whole thing I’m at my wits end on what virus program to use that won’t crash the computer every time it scans…

Please someone help me, this is my husbands computer and he left it to me to fix it since he’s a Norton fanatic and I’m (or I was up until now anyway) an Avast believer (avast has never done me wrong on my computer) I was really hoping to get Avast working for him so he’d have better protection than just stupid Norton. But with Avast just crashing the computer it’s not looking very promising. I honestly don’t know to what other virus program to turn…so…anyway point is I really need help…

Thanks…

DavidR · 2007-04-02T23:31:27.000Z

Did you remove Norton before installing avast ?
I suspect not and there is some conflict going on. avast normally disables some of its elements to try an avoid the conflict.

So it isn’t avast crashing the computer but a conflict between two resident AVs, at least that is what I believe, especially if you didn’t uninstall Norton first.

Try booting into safe mode, keep pecking away at the F8 key to interrupt the boot and select boot into safe mode. Now you can use add remove programs to uninstall avast now reboot, hopefully that should allow you to reboot. Now you have to decide to do the same with Norton, uninstall and reboot, now you can install avast again and reboot.

Norton is notoriously difficult to completely remove and you may need to do more than just add remove programs to uninstall. A link worth looking at, which is a program removal tool that can remove the remnants of a number of different Norton Programs:
Removing your Norton program using SymNRT

system · 2007-04-03T01:39:23.000Z

Yes I did remove Norton before I even downloaded Avast. I used the add/remove programs way during windows normal mode and deleted the program folder it left behind in my program files. Sadly I’m not experienced enough to mess with the registry (or maybe I’m just smart enough not to since I’m unsure about it) so I can’t do anything about any registy entries and I’ve kinda drawn a blank about where else to hunt for delinquint leftovers. I’ll go ahead and do what you mentioned however and see what happens. I’ll post here the results.

Thanks!

system · 2007-04-03T02:33:41.000Z

I went into safe mode and uninstalled avast etc. and hunted for anything else that I might be able to find that Norton left behind, also avast. I then reinstalled avast and did a boot time scan which worked perfectly but found nothing this time. None of that surprises me.

However, when I went to run avast it performed it’s memory test on startup of the program and the instant it finished the memory test (and where it normally would open the program) it crashed the computer and I got the blue screen of death.

This is very irritating, and does not help my case with my husband…LoL Now he really will believe avast is worthless. sigh

I’m beginning to wonder if there isn’t something else going on here…I know avast isn’t that buggy. At least I don’t think it is.

Well if anyone has any more help I’d appreciate it, otherwise I suppose we’ll have to just fdisk it and start from scratch.

Lisandro · 2007-04-03T02:44:00.000Z

apyrofish post:4:

Yes I did remove Norton before I even downloaded Avast.

Remove NAV through Add/Remove programs from Control Panel. Boot.
Use Symantec removal tool following the three steps defined in the SymNRT tool info or here.
Boot.
Install avast! Boot.
See what you get.

You must get rid of Norton before…

system · 2007-04-03T03:06:57.000Z

I have had a similar problem, when running avast it would get to the windows dir and reboot, and since the Internet Explorer had been reset from ver 7 back to ver 6, I had uninstalled IE 6 and tried to install IE 7 but everytime I deleted IE 6 and before I could re-install IE 6, It would reappear - these files would come back
[iexplore.exe, iedw.exe, hmmapi.dll, and the Connection Wizard dir].
When I try to upgrade IE 6 to IE 7, Microsoft does a virus scan and when it gets to the Windows\System 32 dir
the system reboots.
I do not Know what Malware is causing this problem and I can not seem to get rid of it.

Lisandro · 2007-04-03T03:15:19.000Z

StarHunter5 post:7:

I do not Know what Malware is causing this problem and I can not seem to get rid of it.

Did you try to boot in Safe Mode and run avast and other antitrojan tools at that condition?

polonus · 2007-04-03T06:57:38.000Z

Hi apyrofish,

Consider these removal instructions: http://www.spywareremove.com/removeZlob_Virus.html

Else we should consider the smitfraud cleansing routine: http://www.dslreports.com/faq/13935

polonus

system · 2007-04-04T04:14:35.000Z

So far I have done everything everyone has recommended: totally removed Norton with the tool provided and then installed avast again. Still when it scans the computer crashes. Then I installed the free version of Spy Hunter and scanned, it completed the registry and cookies scans but consitantly crashed the computer exactly like Avast did during the file scan. I even rebooted into safe mode and did a scan that way with the same results. Also around that time I tried searching the computer using the windows start menu search and during that search the computer crashed again. It seems that whenever any program including windows tries to do a search on the computer it crashes.

Thanks for all the help and suggestions, my husband decided he will simply let me fdisk it eventually once we buy windows. (Prebuilts it seems don’t come with a full version for installing after an fdisk.) I wish this story had a happy ending but ya can’t win 'em all eh? sighs

Lisandro · 2007-04-04T18:50:40.000Z

apyrofish post:10:

Then I installed the free version of Spy Hunter and scanned, it completed the registry and cookies scans but consitantly crashed the computer exactly like Avast did during the file scan.

Hmmm… seems complex…
Can you boot in Safe Mode and run avast from there or even schedule a boot time scanning?
I suggest full computer on-line scanning:
Kaspersky
Trendmicro housecall
Ewido
F-Secure
Panda ActiveScan
BitDefender (free removal of the malware)

system · 2007-04-04T18:56:40.000Z

Hi Apyrofish :

 "SpyHunter" is NOT a "Trustworthy" antiSPYWARE program, per Expert
 Eric Howes on his website; he has this to say :
"Note on Enigma SpyHunter:  Enigma's SpyHunter anti-spyware application was listed on this page primarily because of the company's history of employing aggressive, deceptive advertising (1, 2, 3, 4, 5). The company was also known for exploiting the name "spybot" in its domain names and online advertising. These objectionable business practices were employed primarily from late-2002 to mid-2004.

Sometime during summer of 2004 the company halted the most obnoxious and objectionable aspects of its online advertising. It also unloaded all the “spybot” domains (which were promptly picked up by Paretologic for its XoftSpy anti-spyware application).

While there are still unresolved allegations that SpyHunter transmits the Windows Product ID from users’ PCs (1), we can no longer classify this application as “rogue/suspect.” Nonetheless, SpyHunter – at least in its current state – cannot be recommended because of its mediocre performance as an anti-spyware scanner. Testing indicates that it does not recognize some well-known spyware installations and has difficulty removing critical spyware/adware files even from those it does recognize (1). Given the many excellent competing anti-spyware applications that are available (some for free), users would do better looking elsewhere for trustworthy anti-spyware protection.

Domains: enigmasoftwaregroup.com, spywareremove.com, uninstallxupiter.com"

Better to try & use one of his “Trustworthy” products, such as the “Trial”
version of AVG Antispyware from www.ewido.net and/or the FREE ver of
SUPERantispyware from www.superantispyware.com .

“Zlob” is primarily a multi-faceted “Trojan”, and IF those 2 programs do NOT
resolve your problem, it would be best to seek the help of an EXPERIENCED,
TRAINED, VOLUNTEER Malware Expert, usually found on antiSPYWARE
Support Forums, such as the “Spyware Beware” one found at
http://forums.maddoktor2.com/index.php .

Lisandro · 2007-04-04T18:59:12.000Z

Spiritsongs post:12:

it would be best to seek the help of an EXPERIENCED, TRAINED, VOLUNTEER Malware Expert

Hope you’re not saying this to us, as we’re volunteer as they are…

Edited: as Polunus will say, please, keep the CAPS for other occasions 8)

polonus · 2007-04-04T21:44:55.000Z

Hi Tech,

Using capitals on the Internet is considered as a form of shouting. Nobody needs to shout to me, it is not nice.

polonus

system · 2007-04-05T03:04:18.000Z

apyrofish - try this

Download Deckard’s System Scanner (DSS) to your Desktop.
[*]Close all applications and windows.
[*]Double-click on DSS.exe to run it, and follow the prompts.
[*]The scan may take a minute. When the scan is complete, a text file will open - Main.txt
Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard’s System Scanner to run and don’t let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus)

Also download ComboFix to your Desktop.

Double click combofix.exe and follow the prompts.

When finished, it shall produce a log for you. Post that log and main.txt from the C:\Deckard\System Scanner folder into your next reply.

Note: Do not mouseclick combofix’s window while its running. That may cause it to stall

Announcements