Solved Unable to remove Win32/Heur

Status
Not open for further replies.
Ok I did run Flash_Disinfector and deleted 2 folders I found by the name $AVG on G:\ and H:\
Now, am not planning to use AVG again since I had trouble running Combofix. Am using Avira.
I have to tell you that once in a while I got a popup message from Avira Active Guard about a malware found on H:\ and that is moved to quarantine. Here follows the Log from last warning:



Avira AntiVir Personal
Report file date: Πέμπτη, 10 Μαρτίου 2011 10:17

Scanning for 2470218 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 2) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : VASILIS-45A94C9

Version information:
BUILD.DAT : 10.0.0.611 31824 Bytes 14/1/2011 13:42:00
AVSCAN.EXE : 10.0.3.5 435368 Bytes 10/1/2011 12:23:31
AVSCAN.DLL : 10.0.3.0 46440 Bytes 1/4/2010 10:57:04
LUKE.DLL : 10.0.3.2 104296 Bytes 10/1/2011 12:23:40
LUKERES.DLL : 10.0.0.1 12648 Bytes 10/2/2010 21:40:49
VBASE000.VDF : 7.10.0.0 19875328 Bytes 6/11/2009 07:05:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 12:23:50
VBASE002.VDF : 7.11.3.0 1950720 Bytes 9/2/2011 11:15:09
VBASE003.VDF : 7.11.3.1 2048 Bytes 9/2/2011 11:15:10
VBASE004.VDF : 7.11.3.2 2048 Bytes 9/2/2011 11:15:10
VBASE005.VDF : 7.11.3.3 2048 Bytes 9/2/2011 11:15:10
VBASE006.VDF : 7.11.3.4 2048 Bytes 9/2/2011 11:15:10
VBASE007.VDF : 7.11.3.5 2048 Bytes 9/2/2011 11:15:10
VBASE008.VDF : 7.11.3.6 2048 Bytes 9/2/2011 11:15:10
VBASE009.VDF : 7.11.3.7 2048 Bytes 9/2/2011 11:15:10
VBASE010.VDF : 7.11.3.8 2048 Bytes 9/2/2011 11:15:10
VBASE011.VDF : 7.11.3.9 2048 Bytes 9/2/2011 11:15:11
VBASE012.VDF : 7.11.3.10 2048 Bytes 9/2/2011 11:15:11
VBASE013.VDF : 7.11.3.59 157184 Bytes 14/2/2011 11:15:12
VBASE014.VDF : 7.11.3.97 120320 Bytes 16/2/2011 11:15:13
VBASE015.VDF : 7.11.3.148 128000 Bytes 19/2/2011 11:15:14
VBASE016.VDF : 7.11.3.183 140288 Bytes 22/2/2011 11:15:14
VBASE017.VDF : 7.11.3.216 124416 Bytes 24/2/2011 11:15:14
VBASE018.VDF : 7.11.3.251 159232 Bytes 28/2/2011 11:15:15
VBASE019.VDF : 7.11.4.33 148992 Bytes 2/3/2011 11:14:18
VBASE020.VDF : 7.11.4.73 150016 Bytes 6/3/2011 02:00:35
VBASE021.VDF : 7.11.4.74 2048 Bytes 6/3/2011 02:00:35
VBASE022.VDF : 7.11.4.75 2048 Bytes 6/3/2011 02:00:35
VBASE023.VDF : 7.11.4.76 2048 Bytes 6/3/2011 02:00:35
VBASE024.VDF : 7.11.4.77 2048 Bytes 6/3/2011 02:00:35
VBASE025.VDF : 7.11.4.78 2048 Bytes 6/3/2011 02:00:35
VBASE026.VDF : 7.11.4.79 2048 Bytes 6/3/2011 02:00:35
VBASE027.VDF : 7.11.4.80 2048 Bytes 6/3/2011 02:00:35
VBASE028.VDF : 7.11.4.81 2048 Bytes 6/3/2011 02:00:35
VBASE029.VDF : 7.11.4.82 2048 Bytes 6/3/2011 02:00:35
VBASE030.VDF : 7.11.4.83 2048 Bytes 6/3/2011 02:00:35
VBASE031.VDF : 7.11.4.100 97792 Bytes 7/3/2011 02:00:35
Engineversion : 8.2.4.180
AEVDF.DLL : 8.1.2.1 106868 Bytes 10/1/2011 12:23:26
AESCRIPT.DLL : 8.1.3.56 1261945 Bytes 8/3/2011 02:00:39
AESCN.DLL : 8.1.7.2 127349 Bytes 10/1/2011 12:23:26
AESBX.DLL : 8.1.3.2 254324 Bytes 10/1/2011 12:23:26
AERDL.DLL : 8.1.9.2 635252 Bytes 10/1/2011 12:23:25
AEPACK.DLL : 8.2.4.11 520566 Bytes 3/3/2011 11:14:20
AEOFFICE.DLL : 8.1.1.17 205177 Bytes 8/3/2011 02:00:38
AEHEUR.DLL : 8.1.2.83 3338613 Bytes 8/3/2011 02:00:38
AEHELP.DLL : 8.1.16.1 246134 Bytes 2/3/2011 11:15:17
AEGEN.DLL : 8.1.5.2 397683 Bytes 2/3/2011 11:15:17
AEEMU.DLL : 8.1.3.0 393589 Bytes 10/1/2011 12:23:18
AECORE.DLL : 8.1.19.2 196983 Bytes 2/3/2011 11:15:17
AEBB.DLL : 8.1.1.0 53618 Bytes 10/1/2011 12:23:18
AVWINLL.DLL : 10.0.0.0 19304 Bytes 10/1/2011 12:23:32
AVPREF.DLL : 10.0.0.0 44904 Bytes 10/1/2011 12:23:30
AVREP.DLL : 10.0.0.8 62209 Bytes 17/6/2010 12:27:13
AVREG.DLL : 10.0.3.2 53096 Bytes 10/1/2011 12:23:31
AVSCPLR.DLL : 10.0.3.2 84328 Bytes 10/1/2011 12:23:31
AVARKT.DLL : 10.0.22.6 231784 Bytes 10/1/2011 12:23:27
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 10/1/2011 12:23:28
SQLITE3.DLL : 3.6.19.0 355688 Bytes 17/6/2010 12:27:22
AVSMTP.DLL : 10.0.0.17 63848 Bytes 10/1/2011 12:23:31
NETNT.DLL : 10.0.0.0 11624 Bytes 17/6/2010 12:27:21
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 28/1/2010 11:10:20
RCTEXT.DLL : 10.0.58.0 97128 Bytes 10/1/2011 12:23:52

Configuration settings for the scan:
Jobname.............................: avguard_async_scan
Configuration file..................: G:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\TEMP\AVGUARD_f532bcb6\guard_slideup.avp
Logging.............................: low
Primary action......................: repair
Secondary action....................: quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: off
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: high

Start of the scan: Πέμπτη, 10 Μαρτίου 2011 10:17

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'chrome.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'hpqSTE08.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'avshadow.exe' - '1' Module(s) have been scanned
Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'HPWuSchd2.exe' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned

Starting the file scan:

Begin scan in 'H:\System Volume Information\_restore{2E663128-412D-4110-88DE-59CEE8824EA9}\RP30\A0013309.exe'
H:\System Volume Information\_restore{2E663128-412D-4110-88DE-59CEE8824EA9}\RP30\A0013309.exe
[DETECTION] Is the TR/Dropper.Gen2 Trojan
[NOTE] The file was moved to the quarantine directory under the name '4f462837.qua'.


End of the scan: Πέμπτη, 10 Μαρτίου 2011 10:17
Used time: 00:15 Minute(s)

The scan has been done completely.

0 Scanned directories
34 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
33 Files not concerned
0 Archives were scanned
0 Warnings
1 Notes


The scan results will be transferred to the Guard.
 
H:\System Volume Information\_restore{2E663128-412D-4110-88DE-59CEE8824EA9}\RP30\A0013309.exe
Click to expand...

Please note: System Volume are where the System Restore points are held. It is a protected system file and AV scans cannot remove it. As long as the malware is only located there, it is not active in the system. If you should do a system restore now and happen to choose that particular point, then you could reinfect the system. Otherwise, you are in no danger. When we are finished with the cleaning, I will have you drop the old restore points and set a new clean one.

Someday, I hope antivirus programs will be able to read this correctly and not display it to the user, making them think they are still infected.
===========================================
Removing all of the tools we used and the files and folders they created
  • Uninstall ComboFix and all Backups of the files it deleted
  • Click START> then RUN
  • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    CF_Uninstall-1.jpg
  • Download OTCleanIt by OldTimer and save it to your Desktop.
  • Double click OTCleanIt.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
  • You should now set a new Restore Point and remove the old restore points to prevent infection from any previous Restore Points.
  • Go to Start > All Programs > Accessories > System Tools
  • Click "System Restore".
  • Choose "Create a Restore Point" on the first screen then click "Next".
  • Give the Restore Point a name> click "Create".
  • Go back and follow the path to > System Tools.
    [*]Choose Disc Cleanup
    [*]Click "OK" to select the partition or drive you want.
    [*]Click the "More Options" Tab.
    [*]Click "Clean Up" in the System Restore section to remove all previous Restore Points except the newly created one.


Empty the Recycle Bin
=======================================
Now download AVG and save it to your desktop>> don't run it yet.

Boot into Safe Mode
  • Restart your computer and start pressing the F8 key on your keyboard.
  • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

To uninstall Avira:
  • Start> Settings> Control Panel> Add or Remove Programs (Windows 2000/ XP) or Start - Control Panel - Uninstall a program (Windows Vista / 7)
  • Wait for the list of installed programs to load, then click the name of the Avira program.
  • Click Remove next to the program's name (Windows 2000 / XP) or in the menu above the list (Windows Vista / 7).
  • Press Yes, to confirm the removal and then OK.
  • . Click Next until Finish. The software is removed.
======================
Reinstall AVG. Then immediately boot into Normal Mode and update it. Hopefully this will now have removed the Win32/Heur False Positive.

IF you have any problem along the way, let me know.
 
ok good news eset didn't find any threats here's the log:


ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=d5531ca7203fe54797e590b518b5db27
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-02-24 05:41:41
# local_time=2011-02-24 07:41:41 (+0200, GTB Standard Time)
# country="Greece"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 35242 35242 0 0
# compatibility_mode=1032 16777173 100 94 7752 41863832 0 0
# compatibility_mode=8192 67108863 100 0 3900 3900 0 0
# scanned=113439
# found=13
# cleaned=0
# scan_time=3061
H:\office recovery\G\Lost File Results\LostFile_EXE_17977144.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_18174360.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_52609881.exe a variant of Win32/Conficker.Y worm (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_5472056.exe a variant of Win32/TrojanDownloader.FakeAlert.GO trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_63078584.exe a variant of Win32/Kryptik.AY trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_104647160.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_10607648.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_10630496.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_11193632.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_5979896.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_8634784.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_9084792.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_92521216.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=d5531ca7203fe54797e590b518b5db27
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-03-02 10:26:57
# local_time=2011-03-02 12:26:57 (+0200, GTB Standard Time)
# country="Greece"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 526576 526576 0 0
# compatibility_mode=1032 16777189 100 94 8612 42355166 0 0
# compatibility_mode=8192 67108863 100 0 495234 495234 0 0
# scanned=118859
# found=13
# cleaned=0
# scan_time=4043
H:\office recovery\G\Lost File Results\LostFile_EXE_17977144.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_18174360.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_52609881.exe a variant of Win32/Conficker.Y worm (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_5472056.exe a variant of Win32/TrojanDownloader.FakeAlert.GO trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\LostFile_EXE_63078584.exe a variant of Win32/Kryptik.AY trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_104647160.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_10607648.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_10630496.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_11193632.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_5979896.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_8634784.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_9084792.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
H:\office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_92521216.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=d5531ca7203fe54797e590b518b5db27
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-03-10 09:13:25
# local_time=2011-03-10 11:13:25 (+0200, GTB Standard Time)
# country="Greece"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 1214219 1214219 0 0
# compatibility_mode=1024 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775141 100 93 0 36285366 188346 0
# compatibility_mode=8192 67108863 100 0 1182877 1182877 0 0
# scanned=142897
# found=12
# cleaned=0
# scan_time=3187
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\LostFile_EXE_17977144.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\LostFile_EXE_18174360.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\LostFile_EXE_52609881.exe a variant of Win32/Conficker.Y worm (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\LostFile_EXE_63078584.exe a variant of Win32/Kryptik.AY trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_104647160.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_10607648.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_10630496.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_11193632.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_5979896.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_8634784.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_9084792.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
G:\_OTM\MovedFiles\03042011_113550\H_office recovery\G\Lost File Results\Identified [Virtual NTFS Partition @ 0]\LostFile_EXE_92521216.exe a variant of Win32/Kryptik.AAQ trojan (unable to clean) 00000000000000000000000000000000 I
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=d5531ca7203fe54797e590b518b5db27
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-03-15 10:08:01
# local_time=2011-03-15 12:08:01 (+0200, GTB Standard Time)
# country="Greece"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 1647177 1647177 0 0
# compatibility_mode=1032 16777173 100 94 3911 43475767 0 0
# compatibility_mode=8192 67108863 100 0 1615835 1615835 0 0
# scanned=151431
# found=0
# cleaned=0
# scan_time=5506

Shall I run a scan with AVG just to make sure? I've already updated
 
Make sure you have done the cleanup of the cleaning tools first, including setting new restore point, dropping old restore points. Reboot the computer. AVG should no longer show the System Restore> OTM entries. If it does and they are the same ones I had you remove, just delete the contents of the AVG quarantine folder.
 
Hey Bobbye, I think we did it!
I cleanup all the tools and previous restore points and made a new scan with AVG and no virus where found!
Is there anything else I should do before I thank you!? :)
 
It's okay to thank me now! ;)The system is clean. Make sure you have disinfected whatever you used for the office recovery.

Use any or all of the following to stay safe and clean:
Tips for added security and safer browsing:
  1. Browser Security Settings: Custom is fine if the user did the settings. Mine are Custom. Default is okay too, but sometimes too restrictive.
    This Tutorial will help guide you through Configuring Security Settings, Managing Active X Controls and other safety features: Make Internet Explorer safer.
  2. Have layered Security:
    • Antivirus Software(only one):Both of the following programs are free and known to be good:
      [o]Avira-AntiVir-Personal-Free-Antivirus
      [o]Avast Free Version
    • Firewall (only one): Use bi-directional firewall. Both of the following programs are free and known to be good:
      [o]Comodo
      [o]Zone Alarm
    • Antispyware: I recommend all of the following:
      [o]Spywareblaster: SpywareBlaster protects against bad ActiveX. It places kill bits to stop bad Active X controls from being installed. Remember to update it regularly.
    [o]Download ZonedOut and save to your desktop. this replaces IE/Spyad and manages the Zones in Internet explorer. This places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
    For IE7 and IE8, Windows 2000 thru Vista. No Windows 7 yet.
    IE/Spyad is not longer being supported. If you have this on your system, you should replace it with the following program. Make sure your IE8 is Up-to-date before adding sites to your restricted zone.
    Known issue: If you have "immunized" your computer with Spybot Search and Destroy, and use ZonedOut to "Remove All" restricted sites - ZonedOut will remove your trusted sites as well. Note that if you remove Spybot Search and Destroys Immunization the problem goes away...
    [o]Replace the Host Files
    MVPS Hosts files This replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
    [o]Google Toolbar Get the free google toolbar to help stop pop up windows.
  3. Stay current on updates:
    [o] Visit the Microsoft Download Sitefrequently. You should get All updates marked Critical and the current SP updates.
    [o]Visit this Adobe Reader site often and make sure you have the most current update. Uninstall any earlier updates as they are vulnerabilities.
    [o]Check this site .Java Updates Stay current as most updates are for security. Uninstall any earlier versions in Add/Remove Programs.
  4. Reset Cookies to prevent Tracking Cookies:
    [o]For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> check 'override automatic Cookie handling'> check 'accept first party Cookies'> check 'Block third party Cookies'> check 'allow per session Cookies'> Apply> OK.
    [o]For Firefox: Tools> Options> Privacy> Cookies> check ‘accept Cookies from Sites’> Uncheck 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')
    I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
    AdBlock Plus
    Easy List
  5. Do regular Maintenance
    Remove Temporary Internet Files regularly:
    [o]ATF Cleaner by Atribune
    OR
    [o]TFC
    Disable and Enable System Restore:
    [o]See System Restore Guide This will help you understand what this is, why you need to clean and set restore points and what information is in them.
  6. Practice Safe Email Handling
    [o] Don't open email from anyone you don't know.
    [o] Don't open Attachments in the email. Safe to your desktop and scan for viruses using a right click
    [o] Don't leave your personal email address on the internet. Have a separate email account at one of the free web-based emails like Yahoo.
Use a Site Advisor! I use the Web of Trust (WOT) which is an add-on safe surfing tool for your browser. Traffic-light rating symbols show which rate the site for Trustworthiness, Vendor Reliability, Privacy, Child Safety.Your online email account – Google Mail, Yahoo! Mail and Hotmail is also protected.

Every time to do a search and the screen comes up with the sites, they will have the rating light. Green (2 shades), Amber/Yellow Caution, Red> not advised. A few sites haven't been rated and show as a blue flashlight. :http://www.mywot.com/en/download
 
Thank you very much for all the support!!
I'll keep in mind all the advices and tips!

Thanks again!
 
Status
Not open for further replies.

Similar threads

C
Solved Malware \ProductData + possibly more, on two devices
Replies
4
Views
7K
Broni
Broni
E
Solved Svchost.exe launching multiple iexplore.exe - unknown cause
Replies
23
Views
3K
Broni
Broni
NonTechyDad
Solved Malware removal for my son's pc
2
Replies
33
Views
5K
Broni
Broni

Latest posts

Back