Antispyware XP

[Dr Jay]

Are those J drives external, or flash?

[rstoddard]

Sorry for the delay. Working again.

I have an external hard drive which always shows up as N, P or O. Flash drives show up as one of those drive letters too. (Of course, I can re-assign them.) I never leave the external drive or a flash in the computer when I am not using them. They are for data only. I have no programs on them. I also scan them regularly with Zone Alarm.

Nothing ever shows up as J. When I go into "My Computer," and click on J (there's only one), the message that I receive is "Please insert disk into drive J."

[Dr Jay]

Ok. Remove those drives from the system please, and try to enter the Recovery Console again.

Let me know what choices you have there.

[rstoddard]

Actually, I didn't have those drives attached when I tried it the first time. The only other thing plugged into a USB port is Magic Jack (the telephone). So, I removed that and tried again.

Now, it gives me the choice of 1=I:\I386, 2=I:\MiniNT.

[Dr Jay]

Avira AntiVir Rescue System is a Linux-based application that allows accessing computers that cannot be booted anymore.

• Download The Avira AntiVir Rescue System from Antivir.de.
  
• Just double-click on the rescue system package to burn it to a CD/DVD.
• Then please use that CD/DVD with Avira Rescue System to boot your computer.

You'll get a boot option to either boot from hard drive or AntiVir Rescue System.


Press the number 2 on your keyboard to boot into AntiVir Rescue System.

Please wait until drivers are loaded and Main menu shows. Then please select the second option “Scan your system with AntiVir” and hit Enter.


Under Configuration, please select Scan all files, Try to repair infected files and Rename files if they cannot be removed?.


Then please start the scan.

The Avira AntiVir Rescue System wil now

• repair a damaged system,
• rescue data,
• scan the system for virus infections.

[rstoddard]

Hello. I have done as you said, but the program did not appear the same as your screen shots. First of all, the Boot Options were reversed (no.. 1 was the Rescue System and no. 2 was boot from hard drive.) I don't know if that makes a difference.

Then, when I chose number 1, it went right into the Rescue System. It did not give me any of the choices as to what to scan, but went right into a scan.

It found some infections, but gave me no options. I couldn't get out of the program and had to manually reboot the system.

Should I run it again to see if it removed the infections?

[Dr Jay]

Sure.

[rstoddard]

Hello.

I ran the Avira AntiVir System again. Here are the results:

Renamed 4
Suspect Files 0
Warnings 18

The warnings were mostly about incomplete scans of certain files because parts of them were encrypted.

Other changes: Zone Alarm indicated that it had found a "new network." And, Microsoft is saying that there are updates available (I did not install them).

Does that information help any?

[Dr Jay]

Please re-open Malwarebytes, click the Update tab, and click Check for Updates. Then, click the Scanner tab, select Perform Quick Scan, and press Scan. Remove selected, and post the log in your next reply.

[rstoddard]

O.K.

Here it is:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4005

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

4/18/2010 3:51:20 PM
mbam-log-2010-04-18 (15-51-20).txt

Scan type: Quick scan
Objects scanned: 187445
Time elapsed: 27 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\HP_Administrator\Application Data\Adobe\Update\flacor.dat (Trojan.Agent) -> Quarantined and deleted successfully.

[Dr Jay]

Save these instructions so you can have access to them while in Safe Mode.

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
• Double click the setup file to run it.
• Click Next to continue.
• Accept the License agreement and click on next.
• It will, by default, install it to your desktop folder. Click Next.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• Hidden Startup Objects
• System Memory
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)[/color]

Leave the rest of the settings as they appear as default.

• Then click on Scan at the to right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left un-neutralized then click the button that says Neutralize all
• If it says it cannot be neutralized then choose the delete option when prompted.
• After that is done click on the reports button at the bottom and save it to file name it Kas.
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  Note: This tool will self uninstall when you close it so please save the log before closing it.

[rstoddard]

The setup file does not appear while in SafeMode

[Dr Jay]

Do you mean you cannot access the program, or the program's settings?

[rstoddard]

I mean that I do not see it on the desktop while in SafeMode.

[Dr Jay]

Did you try to download it again?

Reboot to Safe Mode with Networking. Does this help?