huge laptop virus issues

kycoo_ghost · 01-02-2006, 10:37 AM

i posted in win95/98 forum about folders not opening. this is a different issue.
Today, I saw a post about Hijack This log help and GeekGirl in that recommended him to use AVG Free Edition. I downloaded it and now I need tech help with it please.

AVG Boot-Up Scanner 7.1
AVG Boot-Up Scanner has detected a virus:
C:\D25C119D.HTA Could be infected VBS/Psyme

We recommend you restart your computer using an operating system from a virus-free system diskette or CD-ROM, then use the AVG Rescue Disk and remove the virus by healing.
Please select one of the following options:
(R)eboot and Restart System From Virus-Free Diskette
(C)ontinue at Your Own Risk

I chose the second option two times. One, after the installation required the restart and then the second time after the recommended update installation’s required restart.Can you tell me what to do when I restart the computer again? What kind of a diskette is it asking for? Is it a normal floppy or a boot floppy?

After downloading and installing all the critical,recommended, and optional updates, i ran the AVG. It found the d25c119d.hta as said before, it also found wun.ini (Trojan horse Downloader.Agent.9.BE) and ABIL.DLL (Trojan horse Startpage. 19.O) and se.dll (Trojan horse Startpage.19.J)

* AVG said it healed everything except the d25..... The others are in the virus vault. Am i supposed to delete them from there somehow.
Are these all just files infected by trojans or are they the trojans themselves. I am new to getting viruses and dealing with them. My older brother, a comp expert isnt here. Help me, please.

tetonbob · 01-03-2006, 09:53 AM

It seems as though AVG is trying to have you boot with known-clean boot disk, to prevent the file from being loaded. Your onboard OS would not be active. You would then use AVG's Rescue disk (which you would have created as part of the install, if memory serves me right) to perform the healing.

Seems to me you could boot to safe mode and delete the file manually, but it also appears as though you have several infections onboard.

You may want to post a HijackThis log in our dedicated forum, to see what else is present.

Please follow MicroBell's 5 Step process outlined here

After running through all the steps, please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\

Double click on HijackThis.exe to run the program.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless.

<edit> NVM - you already have. Follow MicroBell's instructions here </edit>

01-02-2006, 10:37 AM	#1 (permalink)
kycoo_ghost Registered User Join Date: Jan 2006 Posts: 64 OS: Win98	huge laptop virus issues i posted in win95/98 forum about folders not opening. this is a different issue. Today, I saw a post about Hijack This log help and GeekGirl in that recommended him to use AVG Free Edition. I downloaded it and now I need tech help with it please. AVG Boot-Up Scanner 7.1 AVG Boot-Up Scanner has detected a virus: C:\D25C119D.HTA Could be infected VBS/Psyme We recommend you restart your computer using an operating system from a virus-free system diskette or CD-ROM, then use the AVG Rescue Disk and remove the virus by healing. Please select one of the following options: (R)eboot and Restart System From Virus-Free Diskette (C)ontinue at Your Own Risk I chose the second option two times. One, after the installation required the restart and then the second time after the recommended update installation’s required restart.Can you tell me what to do when I restart the computer again? What kind of a diskette is it asking for? Is it a normal floppy or a boot floppy? After downloading and installing all the critical,recommended, and optional updates, i ran the AVG. It found the d25c119d.hta as said before, it also found wun.ini (Trojan horse Downloader.Agent.9.BE) and ABIL.DLL (Trojan horse Startpage. 19.O) and se.dll (Trojan horse Startpage.19.J) * AVG said it healed everything except the d25..... The others are in the virus vault. Am i supposed to delete them from there somehow. Are these all just files infected by trojans or are they the trojans themselves. I am new to getting viruses and dealing with them. My older brother, a comp expert isnt here. Help me, please. Last edited by kycoo_ghost; 01-02-2006 at 10:51 AM.

01-03-2006, 09:53 AM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,572 OS: 2000 Pro; XP Pro; XP Home	It seems as though AVG is trying to have you boot with known-clean boot disk, to prevent the file from being loaded. Your onboard OS would not be active. You would then use AVG's Rescue disk (which you would have created as part of the install, if memory serves me right) to perform the healing. Seems to me you could boot to safe mode and delete the file manually, but it also appears as though you have several infections onboard. You may want to post a HijackThis log in our dedicated forum, to see what else is present. Please follow MicroBell's 5 Step process outlined here After running through all the steps, please download HijackThis - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\ Double click on HijackThis.exe to run the program. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless. <edit> NVM - you already have. Follow MicroBell's instructions here </edit> __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009 Last edited by tetonbob; 01-03-2006 at 09:55 AM.