I have Avasti Internet Security installed in my computer. During the past month, I have been bothered by virus warnings issued by the anti-virus program. Unfortunately, the program has not been able to help me get rid of the virus identified.
What is bewildering is the virus sometimes disappears but would reappear again at a later time; sometimes a boot-scan would identify the virus, but sometimes not. The inflected file could not be deleted from my computer in spite of manual attempts to do so.
Could someone help me solve this problem please?
Following is the sequence of events:
On 19th January, after a boot-time scan, there was a warming that a “threat”, namely, VBC:Banker-EA [Trj] was identified and the location was C:\Windoes\System32\config\SOFTWARE.LOG2. When I tried to fix the problem using the facility provided by the anti-virus program, the operation stopped halfway. When I tried to delete the “virus” from the identified location in my computer manually, the delete action also failed; a window popped up and told me that the file was in use and the delete action could not be completed because the file was open in another program. It however did not say which program.
On 20th January, I did another boot-time scan, this time no virus was identified but instead there was a warming that some files could not be scanned and the file name was identified as: C:\Windows\Installer\65daf8a.msp l>PATCH-CAB. However, I could not (still cannot) find such file in my computer as there is no file by the name “Installer” under Windows.
Upon recommendation by an Avasti technical staff, I downloaded an application called Malewarebytes Anti-maleware and did a scan. No virus was found.
On 26th January, I did another full system scan and many error messages were generated, such as “Error: the process cannot access the file because another process has locked…”, “Error: Archive is password protected (42056)” etc.
On 1st February, I did another boot-time scan, again a virus, same as the one found on 19th January was found but this time the location has changed to SOFTWARE.LOG1 . I tried again to delete this file but again not successful due to the same reason that “the file was in use”.
On 10th February, I did another boot-time scan, this time no virus was identified but there was a warning that some files could not be scanned. However, this time the error message was “Error: data error (cyclic redundancy check (23)”, with same file name C:\Windows\Installer\65daf8a.msp l>PATCH-CAB. Again I could not delete this file manually for the same reason cited earlier.
On 11th February, I did another full system scan and again files were identified as could not be scanned. Surprisingly, the message “Error: the process cannot access the file because another process has locked…” disappeared.
On 13th February, I did another boot-time scan. Same error message as on 10th February, and same file.
On 15th February, I did another boot-time scan and this time virus again identified: VBC:Banker-EA [Trj] and the location was C:\Windoes\System32\config\SOFTWARE.LOG2. Compared with 1st February, the location has returned to LOG2 and not LOG1, though I don’t understand the significance of this change. Again attempts to delete this file failed due to “the file was in use”.
On 16th February, I did yet another boot-time scan, but this time no virus found. What a surprise?
In the early morning of On 17th February, I did a boot-time scan and no virus was identified. But when I did a full system scan later, the virus returned. Same VBC:Banker-EA [Trj] virus and same location of LOG2. Upon completion of this second scan, the anti-virus program suggest that I immediately do a boot-time scan but surprise surprise, no virus was found.
I am now totally lost as whether or not my computer is inflected. How come a boot-time scan and a full system scan can produce two different kinds of results. Could someone help?
