Help! Can't get rid of viruses!

Hi, i scanned my computer with the latest versions of ad-aware and avg free edition and they both found viruses in the restore temp folder. I told both programs to delete the files but they couldn't. Avg says it healed all 31 files and that i have to restart the computer. I pressed 'yes' but everytime it never restarts and it freezes. I don't know what to do. Can someone help me please? Thanks. P.S. I also put my hijacktis log file and somebody told me there was only one thing i needed to fix, so i can't do that either.

 

hi, yeh as jjssj said ewido is a brillaint program and will find spyware, hijackers,trogans, dialers and loads more its graet and its been graet for me, this is the free trial, after the trial you can still use it the only loss is realtime protection it has all the other features http://www.ewido.net/en/download/ , should clean up a bit.

oh yeh, make sure you disable system restore for a while start>controll panel>performance and miantanence>system>click systme restore tab and disable it.

then restart.

theese will help sort it too.

ccleaner http://www.ccleaner.com/
cwshredder http://www.intermute.com/products/cwshredder.html
ad-aware se http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-...
spybot s&d http://www.majorgeeks.com/download2471.html
download, update & run in safemode for the above in this order
online virus scan http://housecall.trendmicro.com/housecall/start_corp.asp

thoose are very usefull too,all that is provided by ddp kindly posting it on other threads itll realy help, make sure you do the online virus scan very good.

theese will help sort it,post back here is still no luck, im sure me and jjssj are more than capable of sorting you out so no worrys ok.

 

Just simply shut down the system restore program ( don´t know the name of it in english ). Reboot, and then turn it back on. That´ll kill the viruses that are on older restore points. After this you can´t ofcourse restore your system, but it´ll start making new restore points after you turn it back on. I´m totally sorry for my English, but I hope you understood what I was trying to say =)

 

thanks for all your help. I'll do some of the scans and then get back to you. But i can't get ewido because i use a windows me system.

 

By the way, i have some trojans, worms and a couple of generics.

 

have you tryed what i told you to try yet?

 

@jjssj

oh i see your sig moves, i couldnt see that in firefox as javascript was disabled, thats a clever sig btw but i prefere theese ones.

i disagree with you there jjssj when you say you should not use freebeis for anti viurs, i went from bitdefender pro to avg free and escan and ive been much beter.

ps, this is the only exception as escan and avg free are top programs and are brilaint freebies, i dont think anything else comes close, maybe avast free.

 

yh, i know jjssj but it's only for temporary use because my norton antivirus subscription ran out and now I am thinking about getting ez etrust antivirus as my main antivirus protection; is it good? And by the way, what's wrong with avg free edition? I think it's a great product and finds more than many non-free products.

 

AVG free is fine use it all you want,why dont you try trend micros products they are top or kaspersky.

that is is you want a new anti virus, anyway try what i told you to and then post back.

i think youll love bitdefender, its got all you need and a excelent anti virus maybe the best.

i hope it works

 

I done what rav009 said but with no results. They can't be deleted. Escan came up with the most results for me. This is the log file:

File C:\_RESTORE\TEMP\A0104170.0 tagged as not-a-virus:AdWare.Win32.PowerScan.d. No Action Taken.
File C:\_RESTORE\TEMP\A0115186.0 infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115187.0 infected by "Trojan-Downloader.Win32.IstBar.ij" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115188.0 infected by "Trojan-Downloader.Win32.Dyfuca.ei" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115189.0 infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115190.0 infected by "Trojan-Downloader.Win32.Apropo.g" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115191.0 infected by "Trojan-Downloader.Win32.Agent.ro" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115192.CPY infected by "Trojan-Downloader.Win32.Apropo.ag" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115193.CPY infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115194.CPY infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115195.CPY infected by "Trojan-Downloader.Win32.Apropo.ag" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115197.CPY infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115198.CPY infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115199.CPY infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115200.CPY infected by "Trojan.Win32.Crypt.t" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115202.0 infected by "Trojan-Downloader.Win32.Dyfuca.gen" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115204.0 infected by "Trojan-Downloader.Win32.IstBar.jm" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115205.0 tagged as not-a-virus:AdWare.Win32.SideFind. No Action Taken.
File C:\_RESTORE\TEMP\A0115206.0 tagged as not-a-virus:AdWare.Win32.SideFind. No Action Taken.
File C:\_RESTORE\TEMP\A0115207.0 infected by "Trojan-Downloader.Win32.IstBar.ms" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0115213.CPY tagged as not-a-virus:AdWare.Win32.SurfAccuracy.d. No Action Taken.
File C:\_RESTORE\TEMP\A0119771.CPY tagged as not-a-virus:AdWare.Win32.SurfAccuracy.d. No Action Taken.
File C:\_RESTORE\TEMP\A0120837.CPY infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121587.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121611.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121612.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121616.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121618.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121619.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121620.CPY infected by "Trojan.Win32.VB.aad" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121625.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121629.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121630.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121634.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121636.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121637.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121638.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121919.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121923.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121924.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121928.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121930.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121931.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0121932.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0122635.0 infected by "Trojan-Downloader.Win32.IstBar.lu" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124934.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124935.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124939.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124941.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124942.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124943.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0124962.1 infected by "Trojan-Downloader.Win32.IstBar.lu" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0126521.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0126522.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0126526.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0126528.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0126529.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0126530.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0130754.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0130755.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0130759.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0130761.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0130762.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0130763.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0137384.CPY tagged as not-a-virus:AdWare.Win32.Altnet.e. No Action Taken.
File C:\_RESTORE\TEMP\A0143849.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143850.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143851.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143856.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143858.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143859.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143860.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143863.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143864.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143868.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143870.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143871.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0143872.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144093.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144100.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144101.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144105.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144107.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144108.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0144109.CPY infected by "Trojan-Downloader.Win32.PassAlert.c" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146150.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146154.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146155.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146159.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146161.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146162.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146163.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146632.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146636.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146637.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146641.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146643.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146644.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0146645.CPY infected by "Email-Worm.Win32.VB.an" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0149467.CPY infected by "Trojan-Downloader.Win32.IstBar.ns" Virus. Action Taken: File to be deleted on reboot.
File C:\_RESTORE\TEMP\A0149468.CPY infected by "Trojan-Downloader.Win32.IstBar.ns" Virus. Action Taken: File to be deleted on reboot.

I rebooted and they still weren't deleted, as i scanned again with ad-aware to find them still there. I don't know what to do! Please help.

 

That's the problem, i can't get ewido, because I use a windows ME system and it's only compatible with windows 2000 or xp. Any other ways?

 

Start a new thread, where you post a hjt-log. Instructions here ( steps 3 and 4 )http://forums.afterdawn.com/thread_view.cfm/263784.

 

i posted a log a couple of days ago and i was told to only fix one line. Shall i do it again and can't i post it here?

 

Don´t post a new one. Your log is fine. Have you tried to run eScan in safe mode?

 

i don't see what the difference is and anyway i can't because i downloaded it on my log in profile of the computer and safe mode only boots in to the first main log in profile of the computer. Are you sure there's no other solutions?

 

It could remove those files it says it removes on reboot if you run it in safe mode. Sure we can try something else, but thats what I would do first =) Can´t you save it for the other user, and then run it in safe mode?

 

thanks for the comment spertti and i understand what you're saying but can you first post the other options, as i don't prefer to go into safe mode and do this stuff.

 

Have you tried any online scanners? Here´s just a few, but you could try some of them:

- Trend Micro http://fi.trendmicro-europe.com/consumer/products/housecall_launch.php

- Panda http://www.pandasoftware.com/products/activescan/com/activescan_p...

- Etrust http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

- Norton http://security.symantec.com/ssc/home.asp?j=1&langid=us&venid=sym...

- Mcafee http://uk.mcafee.com/root/mfs/default.asp

- F-Secure http://support.f-secure.fi/fin/home/ols.shtml

- AuditMyPc http://www.auditmypc.com/

- Shields Up http://grc.com/x/ne.dll?bh0bkyd2

- BitDefender Online scan http://www.bitdefender.com/scan/licence.php



Still my #1 option is the scan in safe mode =)

 

which one would you say is the best online scanner out of those, apart from trend micro?