TR/FWbypass A get rid of

[Guest]

I have had notification from Avira that there are files inside my temp folder that are infected with TR/FWbypass.A.40.
I have researched the virus and apparently everyone only has info on another version of it, 557 i think.

So far it hasn't done anything, although recently counterspy blocked a folder from temp that was trying to change the registry--this sounds in line with that other version of this virus.

So far, Avira offers me to delete, deny, etc. but the virus keeps coming back--every two minutes or so, and if i go to temp the folders that were apparently deleted are still there. None of the others programmes--counterspy, malware--are able to detect it, and of course given the FWbypass nature is "bypasses the firewall".

I have already deleted everything in the temp folder and had no internet window open but nevertheless it reappears, always with a new svchost.exe folder.

My question is: How do I detect the virus outsourcing these infected folders and how do I get rid of it? It's more irritating that dangerous...at the moment.

 

[buwish]

Try booting into safe mode and trying to delete the files. Sometimes this occasionally works.