# VBS:Malware-gen problem



## maimor (Apr 2, 2008)

Hello, I have a problem with VBS:Malware-gen. Avast detects it on start on a C:a.bat file. I delete it with Avast and then Win32.Rbot.aeu is detected by Spybot on a full research. On the registry two "DRam prosessor" appear: 

HKEY_USERS\?\software\Microsoft\OLE\DRam prosessor REG_SZ msconfig.exe ( ? is nothing and sometimes changes to S-1-5...)
HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Currentversion\RunServices\DRam prosessor REG_SZ 

I manage somehow to neutralize this thanks to Chermesh indication on another post for a problem of the same kind. When I replace msconfig.exe by an other safe msconfig.exe in Windows\pchealth\binaries, the problem is apparently neutralized, but starts all over again if I use msconfig so there still is some active part of the virus somewhere. I have also noticed that in pchealth\uploadlb\binaries, the file uploadm is very quickly restored if I replace it by another one (is there a link?). It's two nights I spend on this, please help me!


----------



## Angelfire777 (Oct 15, 2006)

Hi,

Please read and follow this sticky: http://www.techsupportforum.com/f112/if-you-think-your-computer-is-infected-203704.html


----------

