Winantivirus2006 and Panda won't delete!

I can't get rid of this when I scan with Panda. I am assuming it is called that. Panda can only "rename" it. I haven't been having any problems with my computer though but everytime I run the virus scan it pulls it up??

I have XP...just wondered if you have any suggestions on how to get rid of it??

Thanks
Lisa

 

Hi Lisa

Welcome to the best the WindowsBBS

OK do the following:

Download Rogue remover

http://www.majorgeeks.com/downloadget.php?id=5360&file=9&evp=2e0d43eb67e1e71c0b31e62c003599c0

Then download Dr.Web Virus cleaner

ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Boot to safe mode

Run Rogue remover 1st

Then dr web Cure-it

Then boot back to normal, update your virus scanner and see if it is now gone.

Report back for HijackThis scan to see if this is all you have.

Mike

 

Hi Mike
I downloaded the first thing but can't get to the second one..is it because it is a FTP site??

 

It may be some settings. I just tested it and it is ok for me.

Here is a different link

http://download.drweb.com/drweb+antivirus+free+services/#0

Mike

 

Hi Mike
I got the second to download...now, I have XP and how do you restart into safe mode?? I know that is a dumb question but I knew how to in win2000 and others but my computer doesn't show the option to restart in safe when I hit restart...hope that makes sense!

Thanks
Lisa

 

During reboot or after being off. Tap the F8 key during the boot process.

You will get a menu. Safe Mode not Safe Mode Networking.

Mike

 

Hi Lisa

I see you are online. Did you git-r-dun?

I am going to get out of Dodge when you and another are finished so let me know.

Mike

 

I was actually going to wait for a while to try it...have to pick up my daughter in 1/2 hour and didnt want to have to stop in the middle and leave. What does get "out of Dodge" mean?? If you think it won't take that long...I will do it now....

 

Hee hee!

Get out of Dodge. Old saying related to the old western "Gun Smoke" Marshall Dillion.

Means I am gettig ready to knock off for the day!!

Go get your Daughter. I will check back in after Dinner.

Good luck,

Mike

PS My daughter comes to get me. She is in College pre-med. Yeah she comes gets me everytime! When she needs money!

 

Never been much of a Gunsmoke fan

Anyway, I did the 2 scans in safe mode and it did not detect anything. Just rebooted normally and running my virus scan (yes it is updated as well). It isn't done yet but I don't have a good feeling since the other 2 things didn't detect anything.

So, what is this "hi-jack this" scan??

 

It just detected it again and it says "virus has been neutralized" and not deleted just "renamed ". But everytime I do the scan it picks it up again.

 

Hi Lisa

OK we did the simple obvious things first.

But I was perhaps not clear, I intended you to run your Panda in Safe Mode if it will. Some Virus scanners will not run in Safe Mode.

Now, I want you to do the following first, you will be advised when to run Panda below.

Download install and run
http://www.xblock.com/download/xclean_micro.exe
Delete ALL it finds no exceptions, if after cleaning an incident, it advises a reboot say no during the process, but do so when the program ends before continuing with next step below.

Download install and run CCleaner
CCleaner get the slim version http://www.ccleaner.com/download/builds.aspx
Click run Cleaner at bottom right twice. Then click Issues on the left panel, then the Scan for issues at the bottom. Delete the found and run again until it is either clear or has something that will not go.

Download install and run ATF-Clean
ATF-Cleaner http://www.atribune.org/content/view/25/2/
click select all

Download but do not run VundoFix: http://www.atribune.org/ccount/click.php?id=4

Download HijackThis: http://www.bleepingcomputer.com/files/Merijn/hijackthis_sfx.exe

Double-click hijackthis_sfx.exe, click Unzip

Close the window
HijackThis is installed in C:\Program Files\HijackThis

Next

Control Panel-Add/Remove
Uninstall Viewpoint if it exists
Then close all windows

Run HijackThis

click Do a system scan only place a check beside each of these "if" they exist

BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS\Downloaded Program Files\SbCIe02a.dll

HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

Select “Fix Checked”.
Close HJT.

Search for and delete if it exists, C:\Program Files\Viewpoint (use windows search or My Computer)

Then:

Run the VundoFix.exe.
Click the Scan for Vundo
Finish scanning then
Click Remove Vundo
Click YES to remove files, screen will flash off then on
Click yes to reboot

After reboot
Run HJT again “Select Do a system scan and save log file”

The log file will open, Copy this and paste to us

then

browse to C:\vundofix.txt
Copy and paste to post that back to us also.

Now while we are evaluating the above info, Update Panda again even if you did it yesterday. Then reboot to Safe Mode and run Panda if it will run in Safe mode!

Then report the results back to us and by then we will have hopefully perused you logs for other issues.

Lisa this may seem like a lot but the instructions are worse than the doing should take less than 10 minutes to read and do. I advise print it out.

Additionally by doing these things you will learn and be ready for other things later.

Mike

 

Answer to PM.

No! Only the first time do you check the things in HJT.

The 2nd is only to post back to us.

Mike

 

Got your message.....your PM box is full!

 

Yeah I cleaned it.

I have been away from this BBS for a couple of years and only been back for a week or so.

Many old members are sending me welcome back messages and I have to keep an eye on it. Has filled up several times, is clean now.

Mike

 

Ok, I am at the ATF cleaner step...I "selected all" now do I click "empty selected "??

 

Yes and run it again untill it come up empty..
Mike

 

If you are at the ATF step, then what did XClean_micro find?

Mike

 

The x-cleaner found nothing at all. The next one, cc found quite a bit but fixed all issues....does that sound ok?? Getting ready to run HJT now for the first time...Also, Viewpoint wasn't in add/remove programs

 

10-4 proceed on.

Mike