Avast freezes at startup

[gopal]

I made a boot scan (VPS 0626-3) nothing found

sent svchost.exe (in C:\windows\) to jotti and this is the result

AntiVir  Found Heuristic/Hijacker (probable variant) 
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found BehavesLike:Win32.ExplorerHijack (probable variant) 
ClamAV  Found nothing
Dr.Web  Found MULDROP.Trojan (probable variant) 
F-Prot Antivirus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing

[mauserme]

OK, lets see if Dr. Web can help.

Download and run Dr. Web Cure It

http://download.drweb.com/drweb+cureit/

and let us know.



edit   Prior to doing the above, zip and password protect a copy of svchost.exe and email it to virus@avast.com.  Put a short explanation that this is a possibly undetected trojan in the email along with the password, then run Dr. Web Cure It.

[gopal]

Hi
I sent the zip file to virus@avast.com

this is the result of dr web
A0007919.exe   C:\System Volume Information\_restore{6AD47CF3-1EAA-4E54-B404-D4D37EBBFA15}\RP64   Probably BINARYRES
svchost.exe   C:\WINDOWS   Probably BINARYRES
service32[1].exe   C:\Documents and Settings\%USERNAME%\Impostazioni locali\Temporary Internet Files\Content.IE5\WLKJ83GV   Probably BINARYRES

[Lisandro]

Gopal, if a virus is replicant (coming and coming again), you should:

1) Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;310405
2) Clean your temporary files.
3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.
4) Use a-squared or ewido (trojan removers). 

[mauserme]

Hi gopal,

Did Dr. Web put c:\windows\svchost. exe in quarantine? 

If it did then do as Tech said about turning off System Restore - this will delete all your restore points which is the only way to get rid of the infection hiding there.  You can turn system restore on again later.

Also delete the temporary internet files.  I like CleanUp for this since it will mark files for deletion on reboot if necessary

http://www.stevengould.org/software/cleanup/

If you use CleanUp make sure the Delete Prefetch Files option is not checked (deleting these can temporarily slow your computer).

Scheduling an avast! boot scan is fine if you want to do this but, since avast! hasn't been identifying the problem, I would either substitute another Dr Web scan for Tech's step #3 or add Dr Web as step #5.  In either case you need to reboot first.

You can enable system restore at any point after the Dr Web scan if you wish as long as you are coming up clean.