Avast is detecting many files as viruses

[-Genesis-]

My pc cannot extract zip files because I don't have the programs.

You need winrar or winzip to extract the files.

And follow essexboy steps.

Or

You can try my steps

I think you should disable Avast temporarily just for scanning..
 
1. Right click avast ball
2. Avast shield control
3. Disable for 1 hour

I think what you've stated that MBAM is installed on your system now right?

If so?

Update the latest version then try scanning MBAM.

If you really needed removing for malware and viruses? you can visit this site and post you problem their.
http://forums.malwarebytes.org/index.php?showforum=7

[x2397]

I scanned with malwarebytes here's the log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4192

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

6/13/2010 9:32:05 AM
mbam-log-2010-06-13 (09-32-05).txt

Scan type: Full scan (C:\|)
Objects scanned: 123736
Time elapsed: 15 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Microwsoft (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mswupdate (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mswupdate (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe "C:\Documents and Settings\Dollars\Application Data\lsass.exe") Good: (Explorer.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[-Genesis-]

Good!

So still Avast detecting files as viruses?

Im sory but im no expert and authorized for completely removing malware.

Mbam is good but its not complete for removing..

Some case malware still lurking on your system. Even scanning Antivirus + Antimalware no found.

You need powerful tools to remove it but its only authorized malware experts to check it.

Maybe you can try visiting this site.

http://forums.malwarebytes.org/index.php?showforum=7

Post their wait for their reply.

[x2397]

well I did another scan with malwarebytes and nothing. did a scan with avast and nothing. so I think I am clean. But what do I do with the files on the vault?

[-Genesis-]

well I did another scan with malwarebytes and nothing. did a scan with avast and nothing. so I think I am clean. But what do I do with the files on the vault?

What you mean on virus vault? In Avast Virus Chest? or Mbam Quarantine?

Its would be best not to delete them first why?

Some virus and malware can harm your system which malware and viruses infect system files which can cause problematic.

Just observe your system for a week. If its running FINE then you can delete the virus and malware on the quarantine or virus chest.


Btw we have viruses and worms section.

I hope this thread will be moved and can be check by Avast Team Experts and Mods.

[Shiw Liang]

If you need something to extract files you may use 7zip which is a free tool
You may download it here:
http://filehippo.com/download_7zip_32/

Glad to hear that you are clean

[x2397]

well here are the files in the avast chest and all are infected with win32:Trojan-gen:
 A0001910.exe Location: system volume info.

 lsass.exe Location:documents and settings

 unp229685330.tmp and 2 other variants of these with different numbers location: C:\windows\temp\_avast5_

The problem is that I don't know where all the infections originated from.

[x2397]

If you need something to extract files you may use 7zip which is a free tool
You may download it here:
http://filehippo.com/download_7zip_32/

Glad to hear that you are clean

thanks but, as Chubalz said, my system may still be having stuff lurking around even if my AV software and malwarebytes cannot detect it.

[gblu]

well here are the files in the avast chest and all are infected with win32:Trojan-gen:
 A0001910.exe Location: system volume info.

 lsass.exe Location:documents and settings

 unp229685330.tmp and 2 other variants of these with different numbers location: C:\windows\temp\_avast5_

The problem is that I don't know where all the infections originated from.

AFAIK, and CMIIW, lsass.exe is located in the folder C:\Windows\System32, not in the document and settings. (its "l" (L) not "I"(i) )

here's the some links about lsass.exe : http://www.neuber.com/taskmanager/process/lsass.exe.html
http://www.processlibrary.com/directory/files/lsass/

[essexboy]

If you are concerned about stuff lurking - which it may well be

Download OTL  to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Check the box that says Scan All Users
  
• Under the Custom Scan box paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /180

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post both logs

[x2397]

Should I just wait the week and see if my system runs fine and then delete all?