virus in temp file that keeps on reappearing

[eliza6]

hey guys i am currently new here so whats up! I have a huge problem on my computer and was hoping someone could help, i accidentally clicked on an icon and got a virus, i put it in the chest, but every time i turn on my computer this virus keeps on reappearing on the avast scanner and it says its in the temp file, but after i cleaned out the temp file the virus is still there. The virus haven't caused many problems yet except pop ups while on the internet, and i tried scanning but it wont detect it and i have tried other internet scannings and even brought spyware doctor but it doesnt work. i think the virus is in my hidden temp file, but i dont know how to get rid of it!!!!!! HELP PLEASE!!!!!!! i dont really know anything about computers so when replying please tell the solution step by step. thank you!! 

[FreewheelinFrank]

Hi eliza6,

What's the name and location of the file detected by avast!, and what's the name of the malware detected?

For example:

24exhdda.9.exe > C:\DOCUME~1\Julie\lOCALS~1\Temp > 31/05/2007 12:51:22, Win32:Horst-GZ [Trj]

(This will be recorded in the avast! log.)

[Lisandro]

But every time i turn on my computer this virus keeps on reappearing on the avast scanner and it says its in the temp file, but after i cleaned out the temp file the virus is still there.
So when replying please tell the solution step by step. thank you!! 

If a virus is replicant (coming and coming again), I always suggest:

1) Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k. After boot you can enable System Restore again after step 3).

2) Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.

3) Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

4) It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

5) If you still detecting any strange behavior or even you're sure you're not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG, Panda and/or F-Secure BlackLight.

6) After you're clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

If you need more help, just let us know.

[eliza6]

hey this is Eliza6, i just want to that you guys for the help thats been generously given to me. I will go on vacation in a couple of days (hopefully forget about the problem on my computer) and i will try fixing it as soon as possible, and once again, thank you for all your help, keep up the good work and post more solutions for me PLEASE!!!!!! Have a great summer!!!!

[Lisandro]

post more solutions

You need to try the others first
Enjoy your vacations

[eliza6]

         Thanks! I just finished packing for my vacation and suddenly remembered the virus's name. The virus is called         
         Win 32:VBStat-C, and the pop ups are mostly from winantivirus or something like that, I think the virus is a vundo, and the pop ups are possibly rogue spyware. so PLEASE reply for more info, and don't tell me its hopeless, and that the virus is indestructable, thank you times a million!!!

[essexboy]

Download ComboFix from Here or Here to your Desktop.

• Double click combofix.exe and follow the prompts.
  
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
  

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

THEN

* Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
  
• Put a check by Create a desktop icon then click Next again.
  
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
  

Logs required are Combofix and hijackthis

[DavidR]

The winantivirus reference is I believe almost certainly a scumware scam.

A new tool RogueRemover, available here http://www.malwarebytes.org/rogueremover.php

[eliza6]

just one question, why do i have to download HJT high jack this (since i have absolutely no idea how to do that anyways), and how is it going to help? Is there any way where i don't have to download that in order to fix my computer. It looks AWFULLY complicated, HELP!!!!!!!! And i think all i have to do is get a vundo fix thing and the virus will hopefully be gone. Please forgive me for my lack of understanding on computers, i only know how to get on the internet and check e-mails, as for other things i have no idea!

[mauserme]

Sometimes a single solution isn't enough.  Some malware is particularly good at hiding or reinstalling itself and other malware.  This is what is happening on your computer.

The ComboFix tool recommended by Essexboy will likely clean a lot of the problem files from your computer including those that are downloading other malware.   It will also give some information about recently created files that can help narrow down the problem.

The HijackThis log will then list the processes running on your computer and some registry information that will help determine if more cleaning is needed.  Downloading this, running it, copying and pasting the log is really quite easy.  Interpretting the information is a little complicated sometimes, but you don't need to worry about doing that yourself.  You only need to post the information.

[Lisandro]

I think the virus is a vundo

Info for removal: http://encyclopedia.thefreedictionary.com/Vundo

[essexboy]

Is there any way where i don't have to download that in order to fix my computer

NO

And i think all i have to do is get a vundo fix thing and the virus will hopefully be gone.

Just Virtumondo but not the re-inforcements it called in

It looks AWFULLY complicated, HELP!!!!!!!!

Just follow our instructions they will be simple and step by step

[eliza6]

hey this is me again, sorry for freaking out about this and I will be sure to try the combofix and the HJT.

Okay guys, just to be on the safe side, all i have to do is to copy and paste the logs from both programs onto this forum and all will be well? wish me luck and thanks!

[mauserme]

The logs will be long so you may need to use more than one post to fit everything.  If you copy the first half of the HijackThis log  (roughly down to the lines that start with 04) and post that, then post the second half, you should be fine.  Same for the ComboFix log.  Use as many posts as you need - just make sure to include everything in the correct order.

[essexboy]

hey this is me again, sorry for freaking out about this

  A natural reaction the first time you hit a trojan