Won't let me move or repair virus

Viruses and worms
1

I have run a full scan for the last 3 days in a row. It shows that I have a virus & that it is a HIGH threat. It says THREAT: Win32:Adwa. It will not allow me to put it in the virus chest or to repair it. When I try it says ERROR: Access is denied(5). It is really slowing my computer down. What is it & what should I do? :-[

2

Try this

Malwarebytes Anti-Malware 1.46 http://filehippo.com/download_malwarebytes_anti_malware/
always update before you scan so you have the latest database
click on the remove selected button after the scan to quarantine anything found
please post the scan log here

3

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?

  • You could enable a boot time scan. From the avastUI, Scan Computer, Boot-time Scan, Schedule Now button and reboot.

Look in the C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\report\aswBoot.txt file, check this file using notepad for info on the scan/detections, etc.

That should resolve the access denied issue as a) windows shouldn’t be running and b) the file shouldn’t be in use. A repair is unlikely to work even if it were not access denied, as only true virus infected files can even be attempted to be repaired. This isn’t such an infection but adware, were the whole file is malicious so can’t be repaired.

If after moving it to the chest (this is bay far the best option, ‘first do no harm’) it comes back that would indicate that there is a) something there protecting it and b) restoring it, so you will need to run more tools:

If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

Don’t worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.

4

The infected file name is C:\Program Files\iWonIE…\ididle.dll

5

Are you able to expand the column as the … in the path indicates that this is concatenated (more compressed/hidden) ?

Check with windows explorer for a sub-folder beginning with iWoneIE in the Program Files and if so does it ring any bells, e.g. is this a program that you installed ?

Though a google search for ididle.dll (assuming that is correct) returns zero hits which for a dll is somewhat suspect.

So I would proceed with the scheduling an avast boot-time scann followed by scans with the other two tools.