New data:autocheck autochk*\lsdelete\aswBoot.exe

[kitii]

Today I had a warning from avast about a trojan, something like:

C:\DocumentsandSettings\myname\LocalSettings\TemporaryInternetFiles\ Content.IE5\NOQ6GVXL\az(1).htm.
contains sample of VBSbfuscated-gen (trj)

I couldn't move to the chest because the file was being used by another process. So I had the choice of deleting or taking no action. I chose to delete and got this message from spybot:

Category: session manager
Change: value
Entry: boot execute
Old data: autocheck autochk* \lsdelete
New data: autocheck autochk* \lsdelete\aswBoot.exe

I allowed the change, is that OK?

I've deleted my temp internet files too.

I was going to do a system restore to 4 days ago, this would presumably undo that change. Would that matter?

 

[drragostea]

Was my instructions not enough?
http://forums.spybot.info/showthread.php?t=31198
--
As for aswboot.exe:
http://www.bleepingcomputer.com/filedb/aswboot.exe-41400.html
--

I also searched on Google about the process. Half of it came up as good and vice versa. I have avast! on my computer but I do not see 'aswboot.exe' on the Task Manager.

Can you run the scans in SAFE MODE?

 

[md usa spybot fan]

kitii:

Aswboot.exe is the avast! start-up scanner. Most likely because avast! was having problems removing the Trojan it was scheduling a startup scan to see if the Trojan could be removed then.

 

[kitii]

Yes thanks for that info. I've had no subsequent problems anyway.