Author Topic: win32:trojan  (Read 3874 times)

0 Members and 1 Guest are viewing this topic.

Alex31

  • Guest
win32:trojan
« on: May 05, 2005, 12:52:32 AM »
Hi there.
I am an Avast home edition user.  Ive been using avast for a while, through this time I have felt very secure and protected of threads, until now.  Avast keeps finding Win32:Trojano-121, Win32:Trojan-117 and Win32:kuang2, again and again in files inside windows system and system32 folders.  I have deleted them and I have moved them to the chest.  I don't know if there is a relation with this and a suspicious activity of spyware, specifically, every time I turn on the computer or run Internet explorer the internet explorer window appears with the address: about-blank, instead of the one I haved bookmarked for my startup page (and I cannot change it).

Panda did not found the virus.  AVK deleted the virus, then crashed because I didnt forgot to suspend Avast protection and uninstaled AVK in Windows secure mode, AVK deleted a file called outlook.pst, and now Outlook is not operating, Then I used Avast again and found the same virus and Internet explorer problems. 

Please, advice how can I get rid of the problem?

Thankyou

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67236
Re: win32:trojan
« Reply #1 on: May 05, 2005, 01:06:30 AM »
Win32:kuang2
It's tipical related to Panda scanning. These are false detections as per panda active scan: http://forum.avast.com/index.php?topic=12432.msg104932#msg104932

IMSCAN.DLL
PAVDLL.DLL
PAV.SIG
APVXD.VX2
APVXD.VXD

again and again in files inside windows system and system32 folders.
If you find a virus keeps coming back after you delete it, it's most probably infected the System Restore folder, the best way to solve this is to disable System Restore, reboot your machine and then enable it again. After all, run a full avast! scanning. System Restore cannot be disabled on Windows 9x.

Enable/Disable System restore on Windows ME:
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q264887

Enable/Disable System restore on Windows XP:
http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405

I have deleted them and I have moved them to the chest.  I don't know if there is a relation with this and a suspicious activity of spyware, specifically, every time I turn on the computer or run Internet explorer the internet explorer window appears with the address: about-blank, instead of the one I haved bookmarked for my startup page (and I cannot change it).
Could be... changing the home page is one of spyware common actions.
Maybe using SpyBot and Ad-aware scanning will say us more.

AVK deleted a file called outlook.pst, and now Outlook is not operating
Sure... you've deleted the most important personal file of Outlook. The personal folders file with emails, etc.
Do you use MS Outlook or not?
The best things in life are free.