Worms and Errors...

[emrahe]

Hello,

First of all thank you for providing this software free for home users.

I have avast home (current version 4.5.561) , vps 0502-2 installed along with zone alarm 5.5 on my win2K sp4 computer. Have Dsl connection, 24 hours online most of the time.

All Resident Protection elements are up and running. inc. p2p and IM shields.

Sometimes I use edonkey network to download some files and msn is online all the time.

I have been experiencing a couple of problems nowadays so I decided to write here maybe I could find some solutions here.

Yesterday Zone alarm warned me about SVRHOST.EXE trying to connect the internet.  ok probably Adware.Satbo or W32/Agobot-LU, sure a virus. I scheduled a boot time scan on the c:/ drive with avast but no luck it could not find it.  I cleaned it manually following the instructions I found on the net and booted.

Some saskatcw.exe also did the same after the boot , W32/Sdbot-TE  virus later i learned. did the same procedure. Booted again.Ok .

After the boot ZA warned me again for a prog. called tftp.exe. (W32.Blaster.Worm ) . Virus again? yep I did all the same procedure .

After all  these viruses in one day  I decided to boot Win2k in safe mode and scheduled a boot time scan with Avast.

During the the boot, scanning screen of Avast gave an error:

Zw query value key - boot execution error - 0x8000005.

and it stopped.

Now I have a couple of questions, will be glad if you answer them.

1.- Why did not avast warn me about these viruses ?
2.- I am not really sure if my computer is clean now. I scanned whole comp. with avast but, I had done it before too. Is my comp safe now?
3.- What is the error message and how can i fix it?

Thank you
Emrah

[Gillie2tat]

Try downloading the Avast free tool here - http://www.avast.com/eng/avast_cleaner.html it should be able to deal with the blaster worm. 

Disable System Restore before you run it.

Then get Spybot - www.spybot.info - and Ad Aware - www.lavasoft.com - and after you've updated their definitions run full scans.  Click the Immunize button in Spybot when you've run it.

Then reboot into Safe Mode and run Avast.

Then reboot into normal mode, run Hijack This and post back here.

[emrahe]

Thanx for the help Gillie2tat,

All but "reboot in safe mode" worked fine.

 I boot Win2k in safe mode and scheduled a boot time scan with Avast.

During the the boot, scanning screen of Avast gave an error:

Zw query value key - boot execution error - 0x8000005.

and it stopped.

any idea what this is?

thanx

emrah
 

[Gillie2tat]

Hmmm.  I didn't say to do a boot time scan and launch into safe mode though it's not a bad idea:)

Try this.

1. Turn off system restore (if it isn't already turned off)
2. Boot into Safe Mode without running a boot time scan.
3. Do a full system scan including archive files in Safe Mode and try and clean the computer that way.
4. Once you think things are OK reboot into the normal mode operating system, and turn on System Restore, then reboot again to make the System Restore take effect.
5. Then try a boot time scan.

If that doesn't work you'll need the help of Technical and the other Alwil Software people. Sorry that's an awful lot of scanning I know and this is an important thing to fix.

[Lisandro]

If that doesn't work you'll need the help of Technical and the other Alwil Software people. Sorry that's an awful lot of scanning I know and this is an important thing to fix.

Well, I'm not that good... I'm thinking on this since yesterday...
I suggest trying to find something about the 0x8000005 error of Windows 2000.
If I found, I'll post... 

[Lisandro]

I found that pk is trying to 'solve' some other problems... Maybe he can help:

Please send me couple of your latest *.dmp files (from \Windows\Minidump folder) to my email (kurtin@asw.cz). What firewall (+ version) do you use ?