Can't delete infected files

thatgirlsam

Hi

Avast tells me I have some infected files, 10 of them

I can't move them to chest or delete them, it is saying access denied

Can anyone tell me how to get rid of them?

It says 2 of them are high threat - Rootkit: hidden file, and the other is Win32Adware

What does that mean and how can I get rid of them

My ex is coming round tomorrow to have a look, I'm not very technical

Just wondered if there is anything I can do in the meantime

TIA

waddler_8

download this and save it to your desktop.

http://public.avast.com/~gmerek/aswMBR.exe

When you've downloaded it...

• Double click aswMBR.exe to run it (XP), or right click & choose "Run as Administrator" (Vista, Win7)
• With the AVscan set to Quick Scan, click the Scan button.
  
  
• When the scan reports "Scan finished successfully", click Save log & save the log to your desktop.
• Click OK when prompted. aswMBR.txt & MBR.dat will be appear on your desktop.
• Click EXIT.
• Copy & paste the contents of aswMBR.txt & post it here.

Don't click to fix anything yet, just post the log.

thatgirlsam

Hi thanks for replying

Avast said it needed to re-start the computer so I did, and the files seem to have gone!

waddler_8

Still run that utility.

thatgirlsam

I have run the programme but it seems to have been 'stuck' in the same place for quite a while

Its not telling me scan completed successfully, but the option to save log seems to be there

Shall I do that yet or just leave it longer?

It stuck on the Logmein Rescue App!

thatgirlsam

Been stuck in the same place for 35mins now, am I best to shut it down and try again or try to save log?

waddler_8

Sorry, I've been out -

Is it still stuck? See if it will save the log.

If so, click exit > yes to the prompt.

Run it again, but this time set the AV scan to none from the drop down box.

It should only take 1-2 minutes then.

thatgirlsam

Yes, thats worked, thanks

Here is the log

aswMBR version 0.9.9.1618 Copyright(c) 2011 AVAST Software
Run date: 2012-02-20 21:05:11

---

21:05:11.390 OS Version: Windows 6.0.6002 Service Pack 2
21:05:11.391 Number of processors: 2 586 0xF06
21:05:11.393 ComputerName: SAM-PC UserName: Sam
21:05:21.283 Initialize success
21:05:22.250 AVAST engine defs: 12022001
21:05:27.350 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
21:05:27.353 Disk 0 Vendor: WDC_WD2500JS-22NCB1 10.02E02 Size: 238475MB BusType: 3
21:05:27.488 Disk 0 MBR read successfully
21:05:27.491 Disk 0 MBR scan
21:05:27.495 Disk 0 Windows VISTA default MBR code
21:05:27.566 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 5506 MB offset 63
21:05:27.620 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 232967 MB offset 11277630
21:05:27.663 Disk 0 scanning sectors +488395120
21:05:27.923 Disk 0 scanning C:\Windows\system32\drivers
21:06:15.734 Service scanning
21:06:34.450 Modules scanning
21:07:30.610 Disk 0 trace - called modules:
21:07:30.675 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys nvlddmkm.sys ndis.sys e1e6032.sys pacer.sys tcpip.sys NETIO.SYS
21:07:30.685 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86cfc1c8]
21:07:30.692 3 CLASSPNP.SYS[89fa98b3] -> nt!IofCallDriver -> [0x86bec8c8]
21:07:30.698 5 acpi.sys[806946bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x86be4b20]
21:07:30.705 Scan finished successfully
21:07:41.146 Disk 0 MBR has been saved successfully to "C:\Users\Sam\Desktop\MBR.dat"
21:07:41.176 The log file has been saved successfully to "C:\Users\Sam\Desktop\aswMBR.txt"

waddler_8

That looks OK - any problems or more warnings from Avast?

I'd clean out your temp files & run a quick scan with Malwarebytes to be on the safe side.

Here if you dont already have it.
(mbam--setup-1.60.1.1000.exe 9.06mb)

thatgirlsam

Scanned again and Avasr is still showing infected files

Is it OK to scan with Malwarebytes alongside Avast?

waddler_8

Yes, you can run MBAM alongside Avast - decline the trial of the pro version during setup when you see the prompt.
Do this first. it should only take 2-3 minutes.

Download DDS from the link below and save it to your desktop:

Link

After you've downloaded it and saved it to your desktop:

• Double click DDS to run it.
• When it's finished, DDS will open two logs:

1. DDS.txt
2. Attach.txt

Save both reports to your desktop.

Copy & paste the contents of just DDS.txt for now and post it here (you may need to split the log over separate posts)