Win32:RegZonTr[Trj]

[generalpushkin]

Hello. First time poster here, so apologies if this has been mentioned before (i'm sure it will have been) but I have this bad boy virus. It doesn't seem to do much but Avast doesn't seem to get rid of it permanently. Any help appreciated immensely.

[watchthisspace]

Could you please tell us,
What Operating system you have,
Where the virus was found,
What version of avast are you using (program and Vps)

[generalpushkin]

Yeah, its Windows XP Home, the virus was found in C:\WINDOWS\re11.REG, and its Avast 4.5. The Vps is 0449-1.

[DavidR]

A search for Win32:RegZonTr in these forums returns many hits, this is just one of them, try it if it works great, if not check out some of the other results.

http://forum.avast.com/index.php?boarAd=2;action=display;threadid=7904;start=msg63960#msg63960

A registry (.reg) file doesn't just run on its own, something had to initiate it, so you might to do a full check of your system using HiJackThis. Visit HiJackThis - Eddy's Website and click the "HiJackThis Section" and "Malware removal instructions and applications." These will give you the tools and information to run them.

[tuco]

hi i've got the same problem, i'm running xp and every time i connect to the internet i get avast telling me i've got a virus in C:crash.reg. i delete the files, reboot and they're gone, but as soon as i go online it happens again, i'm going round in circles and getting nowhere. any ideas please guys ?

[DavidR]

Start by reading the full thread in the first link I gave above.

Second read my post again (something has to run/initiate crash.reg, it can't run on its own, there is something in the registry that has to be removed as well), there is obviously something else there and you are going to have to do a system check. The second link 'Website' above takes you to Eddy's website.

You can't possibly have been there and carried out the HiJackThis scan and analyse the log file.

If you want to try an on-line scan of your Hijackthis log file try here http://hijackthis.de/index.php

[tuco]

thanks davidr, hijack this has done the biz and got rid of the virus,
again m8 thanks a lot