Every time my PC starts These two things start to bother me. there are located in
C:\Windows\system32
There is a file “WinAvXX.exe” and “printer.exe”
I tried to scan the folder using Avast 4.7 home edition. It doesn’t detect the Files as Virus/Trojan.
This has happened to me a few times. Avast doesn’t detect these things so doesn’t remove them.
This is what the log file (of the scan) contains
C:\Documents and Settings\Home\Local Settings\Temp~DF4E0E.tmp… file could not be scanned!
C:\Documents and Settings\Home\Local Settings\Temp~DF4E14.tmp… file could not be scanned!
C:\Documents and Settings\Home\Local Settings\Temp~DFB98C.tmp… file could not be scanned!
C:\Documents and Settings\Home\Local Settings\Temp~DFB992.tmp… file could not be scanned!
C:\Documents and Settings\Home\Local Settings\Temp\Perflib_Perfdata_26c.dat… file could not be scanned!
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.
[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
Download ComboFix from Here or Here to your Desktop.
[*]Double click combofix.exe and follow the prompts.
[*]When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall
@ maqmo254
Before dealing with these try to send a sample to avast so that they might be added to the detections.
If you are not getting a virus warning that you believe is a new, undetected virus then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest (after adding it to the User Files section of the chest).
Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a either a new, undetected virus and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.
@ essexboy you might want to add a little bit about sending undetected sample to avast in your script.
I downloaded and ran Hijack this. This is the content of the Log file.
I had earlier downloaded and ran AVG Anti-Spyware. It removed both the files successfully. But I have a new problem now. When I started my PC this morning while windows XP was loading, I got errors like " The file printer.exe does not exist.". And the error was also showing the previous location of the files.
It is like windows is trying to run those file every time it start/reboots.
I wanted to remove some softwares and tried to open CONTROL PANEL. but it was not there.
I tried to use the cammand prompt to do so. I get an error “The operation has been canceled due to restrictions on this computer. Please contact your system administrator”.
I was surprised as the PC I am using has only one user and that is me. There are no other user besides me.
I am not able to perform any system administration tasks such as running and stopping the services, changing the time etc. I get the same error every time.
Should I contact my Internet service provider for help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:35:09 AM, on 8/15/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
[/b]Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.
NOW
Download ComboFix from Here or Here to your Desktop.
[*]Double click combofix.exe and follow the prompts.
[*]When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall
I will look at restoring your tools once the initial clean up is done
So here we are over a month later and AVAST is still unable to pick up this virus. I just spent 2 hours cleaning a machine with this virus which included using a barts disk with another cleaner on it and then using a tool called combofix to restore the registry entries.
At no point is AVAST picking up these files (there are actually 3 of them - autorun.exe, printer.exe and the winavxx.exe)
Be nice to have some confidence in AVAST as this virus appears to have come out quite a while ago.
Anyone know if this has been resolved yet? It appears I may yet again get the pleasure of trying to clean this POS from another system with AVAST installed.