Can't get rid of this virus. Suggestions?

[BBCMember]

I've scanned this system three times with AVAST, and each time it has found some threats that it was able to get rid of (boot-time scan). However, when it boots up, it keeps on coming up with the following virus:

avast!: The process cannot access the file because it is being used by another process

Cannot process "C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\DF1H3T7S\Install[1].exe" file

Malware name: Win32:Trojan-gen {Other}

Malware type: Virus/Worm

Anyone know how to get rid of this one? How many time should I scan with Avast before trying something else?

I tried going to that exact path, but it does not exist even with the settings to show hidden files and system files.

Trying to avoid doing a fresh install on this system, as there is a lot of specialized software to install and mapping to do.

 

[cubby1223]

Pull the hard drive out & connect it as a secondary drive to another computer. Run a virus scan from there. Actually, just go in and delete the entire Content.IE5 directory, you don't need any of those files.

You're just going to go around in endless circles cleaning viruses from the very system that's infected.

 

[wanderer27]

Check if it's in your Startup menu, if so delete it.

Probably a good idea to check your Registry (Regedit). HKEY_CURRENT_USER, Software, Microsoft, Windows, CurrentVersion, and check the Run, RunOnce, RunServices, RunServicesOnce.

 

[BBCMember]

It was from the FedEx trojan. I did a search and found that only 7 out of 36 virus engines caught it. So, since Avast was not one of them, I uninstalled it and installed one that did catch it, AntiVir. Thanks.

Just so you know, the contents of that directory was empty, and I was doing boot-time scans. AntiVir took care of it, though. Thanks.

 

[cubby1223]

Originally posted by: BBCMember
Just so you know, the contents of that directory was empty

Empty... or not visible to you. Seriously, if you can find one bad file, chances are there are a half-dozen or more that you still cannot see.

Grab combofix and give that a run:
http://www.bleepingcomputer.co...ix/how-to-use-combofix

 

[octopus41092]

Make sure that system restore is turned off. You can also try different Anti-Virus programs. If you want to be completely safe you can just reformat though.

 

[z1ggy]

Use AVG and super anti spyware from now on too.. They work 100% of the time for me and are both freeware dl's.

 

[wayliff]

disable system restore - boot in safe mode - delete your temporary internet files
throw everything at it - antivir, housecall, etc...

if that still does not work go to http://www.elitekiller.com/malware.htm , read and apply.

 

[BTA]

AntiVir is great

 

[redbeard1]

MS feels the need to hide things from users, including the temporary internet cache folder, especially with XP and Vista. Older versions of Windows allowed you to see them when you had view all hidden and system files.

With XP, even with view all hidden and system files turned on, you cannot view your logged on user profile cache folder. If you are in as the administrator user, or another user who has administrative rights, you can view other people's cache folder.

Using IE to delete your temporary internet cache will clear most of the files in those folders, but will leave the folders themselves.

One way I found to get at most of the special hidden folders is to use a program named EF Commander Free version.

I previously used version 3.81, but I see they recently upgraded the free version. The free version is at the bottom of the page.

EF Commander