Infection in network 2

[copperray]

I will reinstall AVG antispy because it also gets no connection to its server only with deleting the rules.

I will continue with the 2nd PC. It's WinXP SP2. AVG-Free report 2 changes:
ntoskrnl.exe and user32.dll.
Escan and DrWeb did not mention this. Here the attached files.

Updated AVG also reports changed boot sector!

[drongo]

Please run AVZ, go to File - Custom scripts, copy the Code, paste it to Custom scripts window and Run the script.




begin
QuarantineFile('C:\WINDOWS\system32\LIBEAY32_0.9.6 l.dll','');
QuarantineFile('C:\Programme\Topfield to DVD\Mpeg2Schnitt\Muxen\IfoEdit\Run_IfoEdit.exe','' );
end.

After that please upload quarantined file(s) according to the Rules.( http://virusinfo.info/upload_virus.php?tid=9362)

About ntoskrnl.exe and user32.dll.- can you be more specific ? what avg told you about them ? Can you copy and archive (using winzip )them with password virus and upload to us using the link :http://virusinfo.info/upload_virus.php?tid=9362

[copperray]

ok. This was done.
The attached image shows what AVG tells me. Previous scan showed also 'Boot sector C: change'

[NickGolovko]

I'd like to note that it is not necessary a virus problem. AVG can show this after a Windows update, for example.

[Rene-gad]

Previous scan showed also 'Boot sector C: change'
These sentences are not really significant. My NOD found nothing in your files, the upload at virusinfo is queued now; it could take some more time, as usual because of WE.
BTW: It's not correct, to upload the files itself. Pls. use for quarantining only the scripts from helper. If a helper forget to give you one, pls. remind him here.
PS: You have a PM :).

[drongo]

Answer from vir.lab Kaspersky :


Hello.

No malicious software was found in the attached file.
-----------------
Regards, Roman Gavrilchenko
Virus Analyst, Kaspersky Lab.

[copperray]

That's very good. The problems are less than expected. I scanned also from an OS on live-CD and did not find any problem. But for the future I will kepp this under investigation.
For my 3rd PC I found infection in the programs REG1stAid and SPYBOT. I decided to make a new installation in order to profit from a virgin system. Data are on a 2nd drive and clean!
So, for the moment I thank all kindly helpers and I hope not to come back with new problems.

[drongo]

You are welcome :) Anytime!
You are the first user in our english section.I just wonder, how did you find our site ?

[copperray]

I have to thank Rene-gad. He refered me to AVZ4.