Suspect Virus

[Jerry56]

I don't know if the problem is fix or not after fix it was completed i got the following message " Some updates could not be installed. The following updates were not installed, Security update for Microsoft .NET framework 2.0 SP2 on windows server 2003 and windows x86 (KB2633880)."
But the yellow symbol on the toolbar is no longer there.

Yesterday after Avast Antivirus finish it scan the following message was there " C:\System Volume information \_restore (87764440-2F59-41EF-9183-5897467AB919)\RP154\A0041617.dll error oxc0000030 (Data error).

[Jintan]

Malware, or file system issues?

Temp disable your security software.

Click here and download Inherit.exe to your desktop.

Then open Explorer (right click My Computer, left click Explore), and navigate to the following hilighted folder:

C:\System Volume information

Alter the size of the Explorer view so you can see those folders, and Inherit.exe on the desktop.

Then just right click, hold, and drag that folder into Inherit.exe, and release.

Once Inherit completes the permissions changes it makes, a "Finish" popup showing "OK" should appear. Just click the OK button to close that.

Then navigate to that file:

C:\System Volume information \_restore (87764440-2F59-41EF-9183-5897467AB919)\RP154\A0041617.dll

Zip a copy of it, and send it to jintan@malwarecrypt.com as an attachment. Please place "Submitted Files -Jerry56/cth/bad" as the email Subject.

-------------

Go to Start > Run and type or copy/paste:

cmd /c chkdsk c: |find /v "percent" >> "%userprofile%\desktop\checkhd.txt"

Then press OK. A command window will open, and a check of your disk will run. When that finishes, it will create a checkhd.txt log on your desktop. Post those contents back here please. The check disk will take a while to run, so please be patient.

[Jerry56]

When I drag System Volume Information into Inherit , Two (2) options open up 1) Open with 2) Cancel .
I was not sure if i should click " Open with". Should I click open with.?

[Jintan]

Just to be sure, move Inherit.exe to a different location (C drive, or your user's folder) and try that same step from there. That message suggests the system does not know how to run Inherit.exe, though other .exe files have run there so far.

But be sure to do the other step as well please.

[Jerry56]

I moved Inherit Exe. to C drive and to my folder but it still didn't run.

[Jintan]

OK. Go ahead and run that chkdsk step please.

[Jerry56]

I copy the Chkdsk but i don't how to get to paste in " Run" and i can't type the letter before " 1 find "

[Jerry56]

The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
CHKDSK is verifying indexes (stage 2 of 3)...
CHKDSK is verifying security descriptors (stage 3 of 3)...
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

40138370 KB total disk space.
23809864 KB in 60462 files.
23888 KB in 9453 indexes.
0 KB in bad sectors.
174750 KB in use by the system.
65536 KB occupied by the log file.
16129868 KB available on disk.

4096 bytes in each allocation unit.
10034592 total allocation units on disk.
4032467 allocation units available on disk.

[Jerry56]

The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
CHKDSK is verifying indexes (stage 2 of 3)...
CHKDSK is verifying security descriptors (stage 3 of 3)...
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

40138370 KB total disk space.
23809864 KB in 60462 files.
23888 KB in 9453 indexes.
0 KB in bad sectors.
174750 KB in use by the system.
65536 KB occupied by the log file.
16129868 KB available on disk.

4096 bytes in each allocation unit.
10034592 total allocation units on disk.
4032467 allocation units available on disk.
The type of the file system is NTFS.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
CHKDSK is verifying indexes (stage 2 of 3)...
CHKDSK is verifying security descriptors (stage 3 of 3)...
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.

40138370 KB total disk space.
23809876 KB in 60465 files.
23888 KB in 9453 indexes.
0 KB in bad sectors.
175262 KB in use by the system.
65536 KB occupied by the log file.
16129344 KB available on disk.

4096 bytes in each allocation unit.
10034592 total allocation units on disk.
4032336 allocation units available on disk.

[Jintan]

File system looks good. What issues are you still having there now please?

[Jerry56]

The problem is that the files that Avast Antivirus couldn't scan , can't be repair, move to chest and can't be deleted.

[Jintan]

We checked the file system, to make sure they just weren't corrupted files. Not real sure why Avast can't deal with System Restore files though.

Right-click My Computer and select Properties. Click the System Restore tab in the window that appears, and check the box that says "Turn off System Restore on all drives" and click Apply.

You will be asked if you are sure, click Yes. This will delete the restore points. Then click OK in the Properties window and reboot your computer.

When your desktop appears, right-click My Computer and select Properties once more. Uncheck the "Turn off System Restore..." box and click Apply. OK.

Then see if Avast locates those files again.

[Jerry56]

I did the restore point, will advise what happen when Avast Anti-virus scan tomorrow.

[Jintan]

OK, let's see if that did the trick. If you would, reboot at least one time more to complete the Registry changes that made, then check.

[Jerry56]

Avast Antivirus didn't show any error today.