any ANTI-VIRUS good?

[f_vo]

Hi, i use Avast AV, but when i let it scan the full computer, ALWAYS some 11-12 virusses are found. Of course i always indicate to DELETE the file. But no way.

Then i use Windows Live Onecare, again it says 11-12 viruses are found. Again no interaction is done. I hate this.

All i want to find is a AV that does the trick and i do not mean Norton, thanks for that. Norton slows down your machine.

So any ideas are welcome????

Thanks

François

 

[SCSIraidGURU]

What are the viruses Avast can't take care of? Please list them. Did you google them for removal instructions.

 

[f_vo]

hi Michael,

it is the SOBER-AO worm. And until now i cannot delete it. It is situated in Outlook:

so if i remove Office, reinstall it, i need to import my emails again and have the virus again.

c:\Users\swa\AppData\local\Microsoft\Outlook\Outlook.pst\personal

i am afraid that if i delete the whole file, my Outlook....mails (not important) but contact list (important) will be gone.....

But is i could just remove the worm that would be great.

Even if right now nothing happens with the worm on the machine.

thanks

françois

 

[SCSIraidGURU]

Search Avast for it on viruses area.

I would export your messages to a backup folder. Delete it. Shutdown for 5 minutes. Turn on. Run Avast scan again. Create a new account and import them back in.

 

[f_vo]

ok M,

but then i will get the virusses back, since i will export them, import them back in.

Besides i do not need the messages, just my contacts and in my opinion the virusses are in there.

What puzzels me is: i have those worms (not that i am worried) already and probably for some time now and nothing happens, nothing bad i mean.

But i do not want them. If Avast cannot delete them, then what program can without killing my entire Outlook database?

Thanks

François

 

[joel406]

f_vo: Try scanning with spybot.

 

[sidney1st]

But i do not want them. If Avast cannot delete them, then what program can without killing my entire Outlook database?

Attach a hijackthis log and i'll tell you what to do.

 

[f_vo]

ok Si, "HIJACKTHIS" log? you lost me here.



meanwhile i will try spybot.

thanks guys


François

sorry for the late response, but i was in France for a few days.

 

[sidney1st]

Download this prog: http://download.hijackthis.eu/HJTInstall.exe
Install it and run it, attach the generated log here.

 

[f_vo]

hi Sid,

here is what i get: I copy paste since i do not know how to attach a file.

thanks

françois

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:54, on 10/07/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files (x86)\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo!
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Help bij koppelingen - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Verzenden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Verz&enden naar OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/download/scanner/nl-be/wlscctrl2.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL...-jc.cab&File=jinstall-6u6-windows-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

 

[f_vo]

ok Joel, used Spybot, wrong idea....it just deleted my entire contact folder....

Deleting the file i could do myself....just restored the .pst from my back-up.

So Spybot is a dangerous "virus remover".

Apparantly there is no good antivirus program that can remove a virus without deleting the entire file. And this is something i do not get....

François

 

[WildEagle]

First off Spybot Search & Destroy can't remove any viruses that may or may not be on your system, all it does is scan for spyware, and if it detects anything and I do mean anything containing potential spyware, it will remove it.

If you want the absolute best antivirus software, and there is like a 30 day trial for it and an online scanner, get NOD 32 from ESET.

 

[rustyp]

bitdefender.com

Trendmicro.com

both have FREE online scanners

Download Dr.Web CureIt! Free anti-virus scanner, cures computers viruses. Download cureit and run.

The best way I found to remove a virus is to power down remove the hard drive and install it in another computer as a storage drive and run the scanner on it.

 

[sidney1st]

Hi François,
Humm, hijackthis is not fully compatible with X64
Anyway, looks clean, surely the worm you're talking about is "encapsulated" in a mail or something like that.
Did you try to look into the pst file?
When you have been warned by Avast, did it name the infected files. Can you check in the log file the names of the infected files? Is it just talking about the pst file?

 

[f_vo]

Hi Sidney,

no it only talks about the .pst file.

I had F-PROT antivirus for 2 years (not free), but they where not ready for Vista X64 so i switched to Avast.

Anyway Rustip, WildEagle i will try the AV out mentionned here on the board. The one that can remove the virus and the email where it is in, i will keep.

Keep you guys informed. Maybe others are interested too.

François

 

[FrozenEclipse]

You can try a trial of the newly released Kaspersky 2009. It does a better job of removing malware than anything else I've used, including NOD32.

 

[f_vo]

Ok F.E., i will try that one too.

thanks

françois