Cant move virus to chast or delete nothing!!

[Virus Killer380]

Hi to all
I have Avast!4.8 Pro and he has found virus called:Win32:Warezov-MF[WRM and problem is that i cant move him to chest or delete or rename cant do nothing i can only watch how he apear every scaning!!I have also trayed to remove vith boot scan but that scan doesnt find virus!!
When you try to move or something he say:Error operation not suported!!
What can i do???Any idea cause I dont have idea??!!
Thank you in advance

[DavidR]

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ? 
Check the avast! Log Viewer (right click the avast 'a' icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe
 
- Or check the source file using notepad C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log and copy and paste the entry.

What type of scan found this ?

[Virus Killer380]

herre is location of this virus:
C:\Documents and Settings\direktor\Local Settings\Application Data\Microsoft\Outlook\archive.pst\Archive Folders\Top of Personal Folders\Inbox\Livan War real pictures.\picture7453.zip\picture7453.bmp
i cant do nothing about this and to get things even vorse the virus is spreading throght my computer!!!!
help please
type of scan that have found this is very sensitive i made that type of scan when i where crating task!!
and i hawe put ver sensitive!!

[DavidR]

First don't delete this as it could delete the .pst file that it is in with the potential loss of all your emails in that .pst file.

You are going to have to find this infected email and delete it manually from within your email program. Once you have done that then empty your email programs deleted items folder.

How to find the infected email:
Following the path given by avast you should be able to find the infected email.
Starting at your Archive Folders\Top of Personal Folders\ I don't know if this will actually show in the email programs structure, but if so that is your start point.
Otherwise start from your Inbox and try to find the email with the subject "Livan War real pictures."

Don't open the email, it should have a zip attachment called picture7453.zip
Within that attached zip file is the infected image "picture7453.bmp"
I don't believe you can simply delete the attachment so you would have to delete the actual email, "Livan War real pictures."

[mikaelrask]

hey! you could try MBAB and SAS a try.
http://filehippo.com/download_malwarebytes_anti_malware/
http://filehippo.com/download_superantispyware/

if not that works you can try out a rescue CD from Avira, Dr web cureit or bit defender. (just goggle someone of this name rescue CD then fallow the instructions and download and burn from and clean pc (recommended) and then boot from the infected computer.

good luck and write back if you get problems. 

[DavidR]

Lets not start suggesting other applications just yet, considering that:
a) avast does detect it
b) because of the file type and location.
The risk of losing the .pst file and all email, this is something that should be approached with caution.

Since this appears to be an old email in the .pst file, it isn't active so doesn't present an immediate risk, but the potential risk of losing your emails is a risk.

There are no AVs that I'm aware of that are able to extract an infected email from within a .pst file without either corrupting the .pst database or deleting the .pst file. I suspect that this is true of anti-malware, so I think you get the picture of the risk of loss of all emails is higher than the risk of an infected email in a .pst file.

[Virus Killer380]

unfortunatly i cant find that mail and i have trayed maware bayts and superantispyware and doesnt help!what next??

[DavidR]

I'm sorry I can't help you with a manual search of your Outlook email folders, I don't use MS Outlook.

Personally I didn't believe SAS or MBAM would find anything as depending on the .pst file size it would be ignored in scans by SAS and possibly by MBAM too. My concern was in the unlikely event it did scan and find anything.