Author Topic: System32 possible virus  (Read 2993 times)

0 Members and 1 Guest are viewing this topic.

penrat

  • Guest
System32 possible virus
« on: October 18, 2006, 03:57:40 AM »
I ran the first complete scan after installing avast . Upon completion it alerted me that I had one infected file that file was C: Windows/system32/   the name of this is Kaung  . When I tried to move it to the vault it said this was a windows file so I was hesitant to move it ot delete it.  When I tried to repair it gave me the error code 42060.
Does anyone have a clue as to if this is a virus, worm, trogan? Should I delete it move it to a vault leave it alone or what I should do.   
My computer runs fine but I honestly have no clue how long it has been there or where I may have gotten it from.

Thank you in advance

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: System32 possible virus
« Reply #1 on: October 18, 2006, 04:38:18 AM »
If you have (or had) Panda av installed, remove it completely.

penrat

  • Guest
Re: System32 possible virus
« Reply #2 on: October 18, 2006, 06:46:43 AM »
I have done a complete search and I cannot find any kind of Panda file or program on my computer? 
Will it hurt if I just delete the infected file?
I do not ever remember having any program with that name either.. The closest that I have is Pando which I just downloaded.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: System32 possible virus
« Reply #3 on: October 18, 2006, 07:46:03 PM »
I have done a complete search and I cannot find any kind of Panda file or program on my computer?
These could be false detections due to Panda active scan: http://forum.avast.com/index.php?topic=12432.msg104932#msg104932

IMSCAN.DLL
PAVDLL.DLL
PAV.SIG
APVXD.VX2
APVXD.VXD

C:\windows\system32\active scan\pskavs.dll
C:\system volume information \_restore{ ... }\*.dll

 
Will it hurt if I just delete the infected file?
Safer is just send the file to Chest for further analysis.
The best things in life are free.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31079
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: System32 possible virus
« Reply #4 on: November 07, 2006, 02:34:24 AM »
Penrat,

if you browse your harddisk, you will see that there are a lot of files in the Windows folder (and its subfolders). Many of those files are placed there by other applictions then Windows itself. So, a message saying "it is a windows file" doesn't really say/mean much.

Code 42060 means (iirc) that the file is in use. That is the reason that it can not be deleted.
A boottime scan should be able to handle it.

Please send it to the chest as tech advised.
If it turns out to be a false positive, you can always restore it from there.

You can also submit the file to Jotti to see what other av scanners say about it.
(link is on the site mentioned in my signature)

Good luck solving this, and remember......
We are here if you need information/help