[Gunnie]

I have my AVG 6.0 set to scan my pc everyday at 2:00 a.m. I have noticed since having a virus invade my computer that it doesn't show a virus detected anymore like it used to, but the AdAware indicates the virus is still there. I clicked on the details of a scan I did this morning, and this is what it said:

Results of Complete Test, date and time 10/20/2004 7:19:04 :

Testing C:\ serial B8B7-88EB
C:\HIBERFIL.SYS Cannot open; not checked!
C:\Documents and Settings\Kimberly Angel\NTUSER.DAT Cannot open; not checked!
C:\Documents and Settings\Kimberly Angel\ntuser.dat.LOG Cannot open; not checked!
C:\Documents and Settings\Kimberly Angel\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
C:\Documents and Settings\Kimberly Angel\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
C:\Documents and Settings\LocalService\NTUSER.DAT Cannot open; not checked!
C:\Documents and Settings\LocalService\ntuser.dat.LOG Cannot open; not checked!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
C:\Documents and Settings\NetworkService\NTUSER.DAT Cannot open; not checked!
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Cannot open; not checked!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\USRCLASS.DAT Cannot open; not checked!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\WINDOWS\UsrClass.dat.LOG Cannot open; not checked!
C:\WINDOWS\SoftwareDistribution\EventCache\{C9A13C7A-D759-43CA-8713-A2989E25CB6B}.bin Cannot open; not checked!
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Cannot open; not checked!

Test finished, duration 00:19:13.4 s
24037 objects tested, 0 found infected

I think I've got a real nasty in there!

[Advertisements]

What are the details of the virus Adaware finds?

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

Please reboot into safe mode - How do I boot into "Safe" mode?.


Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot your PC. Let us know how it's working.

[admin]

What are the details of the virus Adaware finds?

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

Please reboot into safe mode - How do I boot into "Safe" mode?.


Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot your PC. Let us know how it's working.

[Gunnie]

Nope. I click to download, and it's like I never clicked the go button. I then tried to download the PC-cillin, and I get a HTTP 403 (FORBIDDEN) message.

[admin]

In order to detect whether you are infected by HackDefender, please download this utility: http://bagpuss.swan....torv0[1].62.zip

Unzip and run rkdetector.exe Reply with the log, and any results.

[Gunnie]

I'm still getting the 403 Forbidden page. It won't let me download.

[admin]

Try downloading the attached file.

Attached Files

•  RKDetectorv0_1_.62.zip   65.14KB   244 downloads

[Gunnie]

Nope. HTTP 403 (Forbidden) "You are not authorized to view this page"