AVAST CAN NOT DETECT

[justinmm5]

AVAST can not detect or SCAN and remove viruses such as AUTO.VBS and AUTORUN.INF

that's why my PC got infected

is there anything that we can do about this??

PLEASE... THANKSSSS

[Jtaylor83]

Looks like a flash drive infection.

I suggest Flash Disinfector.

[DavidR]

You could help improve detections by sending a sample of the file/s.

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive/undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn't already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.

Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

In the autorun.inf would be some commands to run a file/s is that the auto.vbs you mention ?

If not you could open autorun.inf using notepad and paste the contents here. Then try and fine the file that is mentioned and send that also.

[polonus]

Hi justinmm5

For the second infection AUTO.VBS, I suggest a solution as below:


1. From the start menu click Run -> type Regedit
(See attached picture as where to do this)

2. Registry Editor will open

3. In the Registry Editor, go to Edit menu and press find

4. In the find dialog box type - virusremoval.vbs and press find next button

5. The search will end at some folder in the registry at the key - "userint"; doubleclick it; you will find many paths separated by commas - eg: c:windows/system32/userinit.exe,c:/windo... and so on. Among those paths you will find "C:\windows\system32\virusremoval.vbs". Delete the path. Ensure that remaining paths are unaltered so that your genuine scripts are not affected.

6. Press F3 (find next) to see if the same path exists somewhere else in your registry. If found again at some other place remove the path there also.

7. Repeat F3 until you get a message that search has finished.
Another solution:

save this and in comp and double click on file so that regedit will be enabled
http://www.dougknox.com/security/scripts/regtools.vbs

polonus

[Lisandro]

After you get clean, consider installing an USB firewall (http://www.net-studio.org/application/usb_firewall.php).