Author Topic: Avast Detects and erase but they keep coming back!  (Read 6906 times)

0 Members and 1 Guest are viewing this topic.

Voodoo

  • Guest
Avast Detects and erase but they keep coming back!
« on: May 16, 2005, 11:14:53 PM »
Avast detects and erases the following two viruses :

Win32:Trojano-1293 [Trj]
Win32:Adan-046 [Adw]

They both come from respective files: Nail.exe
and eptwfmvrs.exe which loads themselves int he windows directory

When I check in the registry I find and erase the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell

The shell referes to: Explorer.exe C:\WINDOWS\Nail.exe

....but it keeps loading itslef back, even in safe mode!

Any help will be appreciated!  ???

The Maxx

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #1 on: May 16, 2005, 11:16:48 PM »
If you're using WinXP you need to turn off System Restore.  Viruses can hide in System Restore and they'll just keep reinstalling theirselves that way.  So turn it off and run the scanner again, once you know they are all gone you can turn System Restore back on.

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: Avast Detects and erase but they keep coming back!
« Reply #2 on: May 16, 2005, 11:21:43 PM »
Do you have a firewall? Are your OS, browser and browser plug-ins (Java) the latest versions?

No firewall or old, unpatched OS and browser can let Trojans straight back in.
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Voodoo

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #3 on: May 16, 2005, 11:29:46 PM »
Thanks for the reply!

I am running SP2 and I have turned off system restore long ago!

I ran all the suggested program: Hijack This, Ad Aware, Online Scan, ONline Trojan Scan, Ewido to no avail. They keep detecting and repairing, erasing, fixing, in "safe mode" but they keep coming back!

Voodoo

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #4 on: May 16, 2005, 11:48:14 PM »
I just found out that I cannot load th Windows Firewall. SOmehow the virus preventes me form doing so!

kamulko

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #5 on: May 16, 2005, 11:55:26 PM »
try to see if this malware is related to some service. go to the panel of services. The second solution (?) is to use WinPatrol (last version). With this little program i stopped an exe file apparently impossible to delete. Was an exe, like your, some months ago. This was the last hope after I make all the possible things. Sometimes the easy things are the better!  ::)

Voodoo

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #6 on: May 17, 2005, 01:17:18 AM »
I got winpatrol and another firwewal and the system seems to be more stable but How do I enable the SP2 firewall? If it is a service, what's its name and How do I get it back on?

Thanks again for the support

kamulko

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #7 on: May 17, 2005, 01:27:24 AM »
Open WinPatrol: you can see the services and click on info after you've selected one. I don't use Win Integrated Firewall and I don't remember the name of the service related. Now I search for it.

kamulko

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #8 on: May 17, 2005, 01:29:00 AM »
PS: doesn't you access to the Windows Firewall from the Control Panel? It is here surely. look.

Voodoo

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #9 on: May 17, 2005, 01:30:05 AM »
Ouch! The damages seem to be deeper than I imagined! I keep running Ad Aware and I find VX2 malwares and the files came back ddespite the firewall! It seems like many of the original windows files have been modified but I do not have any confirmation of this! The online scan did show me that the explorer.exe file was corrupted but How do I fix it?

Also Can someone point me toward findong how to schedule a boot time scan?

Thanks! ::)

Voodoo

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #10 on: May 17, 2005, 01:31:37 AM »
the windows firewal is in the control panel but it tells me that it "cannot load/open ICS/ Windows Firewall " I have no clue!  ??? ::)

Voodoo

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #11 on: May 17, 2005, 01:35:39 AM »
Also when I try to find my network connection properties, it tells me that the Windows Management Instrumentation is not working properly or is corrupted!

HELP PLEASE!  :'(

kamulko

  • Guest
Re: Avast Detects and erase but they keep coming back!
« Reply #12 on: May 17, 2005, 01:47:15 AM »
My God... be calm now... here are some experienced guys (not referred to me :)). Surely they can help you. Now we can try something. The first thing is: right click on the avast blueball - open avast antivirus - menu - schedule a scan at reboot