Avast is detecting my safe programs. What should I do?

[jalovitrue]

When you over installed windows all of the infected files were still on your system - this is why you appeared to have got infected without doing anything...The infection was already there.  Access one file on the old windows folder and you were doomed. 

So a total wipe will be the only option, start with a clean drive.  Windows 64 bit will run 32bit programmes, at the moment there are very few true 64 bit programmes around. 

As for your programmes, again fresh copies rather than backed up ones

For your Backup drive scan it with both Avast and Dr. web - let it delete or cure anything that it finds

Download Dr Web from here http://www.freedrweb.com/?lng=en link on the top right of the page, tick the EULA and then download
 
It will download as an 8 digit file save it to your desktop

Restart in safe mode and run
Accept the enhanced version
Then run the quick scan
About halfway through you will be prompted to buy - just X the box closed

 

Hm, okay I will try this one. So after I scanned and cured / deleted it with Dr.Web and Avast, do I still have to format my disk? I hope I don't have to. And it looks like I need to scan my external HD too?

And, I can see that I can't use my backed up programmes anymore. But what about my files? Like my videos, pictures, etc, if Avast and Dr.Web doesn't detect anything, is it possible to keep them?

Thank you very much for your assistance. I hope you'd help me to the end.

[doktornotor]

You cannot cure this one. I do not know how many times that needs to be said. If you dislike the advise to reformat and reinstall, then do what you wish but do not ask here. And yes, you need to scan everything that you have attached to the computer.

[Pondus]

If you read what Essexboy said..

So a total wipe will be the only option, start with a clean drive.  Windows 64 bit will run 32bit programmes, at the moment there are very few true 64 bit programmes around.

and this is for the backup drive only

For your Backup drive scan it with both Avast and Dr. web - let it delete or cure anything that it finds

[doktornotor]

Yeah. And disconnect any external drives and do not connect those back until you have disabled autorun after reinstall.

[Pondus]

Some info about file infectors from the Assistant Director of Research @ Malwarebytes
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

And even though an Antivirus is able to disinfect the files, in a lot of cases, many files will be corrupted anyway > result > many programs won't work > loads of errors > corrupted Windows + there's still no guarantee that the Virus is really gone.
So why bother to clean this if a format and reinstall is the fastest and especially the safest solution?

In anyway, that's how I see it. Imho, dealing with such infections is a waste of time and that's why I prefer the fastest and safest solution - which is a format and reinstall.

[jalovitrue]

Oh, I see. I'm sorry, I thought it was for my entire HDD. By backup drive, do you mean, in my case, is drive D?

And, sorry for asking this so many times, but I still don't get the answer: what is going to happen to my files (videos, images, etc.)? I keep them on the D drive, and if the scan proves it clean, is it safe to keep them or do I still have to format the drive also?

Thank you for pointing things out,doktornotor & Pondus.

[essexboy]

If the D drive comes out clean then you are OK

[danny96]

If the system files aren't infected then is there no reason to reformat your disc. Do a boot-time scan with avast! and try If you cannot repair all infected files.

[doktornotor]

If the system files aren't infected then is there no reason to reformat your disc. Do a boot-time scan with avast! and try If you cannot repair all infected files.

Yet again ignoring all the information posted here by multiple people about how this infection plain cannot be repaired - are you doing this on purpose or what? Please go Google about the virus if you decided to ignore all people here since they are obviously dumb and do not know anything. Perhaps you will finally understand then after you have read tens of other articles which all state the same what has already been repeatedly stated here.

 

[Lisandro]

Yet again ignoring all the information posted here by multiple people about how this infection plain cannot be repaired - are you doing this on purpose or what? Please go Google about the virus if you decided to ignore all people here since they are obviously dumb and do not know anything. Perhaps you will finally understand then after you have read tens of other articles which all state the same what has already been repeatedly stated here.

No need for acid tone.
This is NOT the avast forum atmosphere.
If you can't help, if the user won't listen, please, don't post.
The forum got an acid atmosphere and this is NOT what we want.
My personal opinion as usual. But... I'm not alone, for sure.

[doktornotor]

No need for acid tone.
This is NOT the avast forum atmosphere.
If you can't help, if the user won't listen, please, don't post.
The forum got an acid atmosphere and this is NOT what we want.
My personal opinion as usual. But... I'm not alone, for sure.

Well, if people keep providing completely wrong advice then I will jump in no matter whether they like the "acid" tone or not. The lack of understanding of the nature of this infection by danny96 is really apalling.

Let me state once again:

1/ You cannot disinfect a machine infected by Ramnit from a running system. To sucessfully stop the infection, a PE or another boot disk (like live CD) is required. Otherwise, even any tool that is being used to disinfect the box will get infected as well. Heck, see Avira reporting its own files as infected above.

2/ Even if you succeed in stopping the spread of infection, by that time you have thousands and thousands of damaged EXEs/DLLs/HTML files. Those cannot be repaired in a reliable way, so you are left with compromised binaries that may malfunction or even serve as a means for another attack. Mind you, this one installs a trojan (complete remote control over your machine) and a rootkit as well usually (to hide the malicious activity.) So, the infection can just come back anyway. Best case, you will have a randomly crashing OS and applications.

So, may I suggest that anyone here stop confusing the OP with claims how this can be fixed and cured? I have asked repeatedly, only for danny96 to come beat the dead horse once again.

 

[Lisandro]

Well, if people keep providing completely wrong advice then I will jump in no matter whether they like the "acid" tone or not.

And I will jump all the times to keep the forum atmosphere a friendship place.
You will have my posts on that each time.
You can, better, should correct the information. But none of us are saviors or God.
The tone must be kept all the times.
I'm not discussing technical issues.

[doktornotor]

I'm not discussing technical issues.

At least 3 different people have explained here why reinstall from scratch is the only safe option here, explaining in detail the nature of the infection and even their own experience with exactly this infection. And then, half a day later, danny96 comes, apparently knowing nothing about the subject and previous debate (or just ignoring it) and starts over.

So - yeah, and I call BS when there is BS posted if someone shows absolutely ignorant attitude like this. We will agree to disagree, I am afraid.

[Lisandro]

So - yeah, and I call BS when there is BS posted if someone shows absolutely ignorant attitude like this. We will agree to disagree, I am afraid.

Yeah... We will disagree hardly I'll say.
You won't stay here calling that other posts are BS for sure.
Not that you will stay alone doing that.
You could have all the technical reasons in favor of you. But you lost the tone: friendship, helpful, respect.
If you're angry, please, don't post. Be helpful. Be friendly. Be calm. Then, please, post

I'm referring to the tone (not the technical aspects).

Are you doing this on purpose or what? Please go Google about the virus if you decided to ignore all people here since they are obviously dumb and do not know anything. Perhaps you will finally understand then after you have read tens of other articles which all state the same what has already been repeatedly stated here.
 

[doktornotor]

If you're angry, please, don't post.

Wonderful. It will be a whole lot better to let people spread malware onto their other boxes and let the malware guys over there in China or Russia steal their banking information etc., simply because someone suggested that in a friendly way. Obviously a whole lot better than to tell people to stop posting and listening to such BS - because, mind you, it is not "friendly".

Here is another couple of suggestions:

- If you have no clue about the subject, read the entire thread at minimum.
- If you still disagree with all the reasons posted, you better should come with damn good arguments why you disagree.
- If you do not understand the subject even after reading all the information and references provided and are unable to come with any good arguments, then - may I suggest - do a service to others and please, don't post. Especially if you have the "avast evangelist" nonsense right under your nickname. People for whatever reason take it seriously in a way that you know what you are speaking about. Sadly, not always the case, as documented here.

IMNSHO, the amount of technical nonsense posted here exceeds acceptable level. There are zillions of other places to chat, this one should be technically oriented.