Avast found a "win32 trojan-gen", won't send it to Chest or Delete it?

Viruses and worms
1

Avast found “win32 trojan-gen”, won’t go to Chest/Delete it? What if I were to uninstall/delete Roxio(source)?
Avast found a “win32 trojan-gen”, won’t send it to Chest or Delete it?
I plan to go into safe mode, but what else can I do? I’m installing malwarebytes and superantispyware. What next?

It’s in the program file of Roxio, Superantispyware, Spybot S&D, and Malwarebytes has found nothing relating to the trojan, What to do? I haven’t gone into safe mode yet and Avast seems to be the only one picking up on this.

Ok I have done a system restore back to 3 days ago, 20th, now what od I do> I searched but it’s still coming up.

It’s in C:\Program Files\Roxio\ Roxio\ MyDVD Basic v9\VideoCore 9\DeInter.ax

Thank you and please help me, I’d hate to ruin this comp.

2

[font=Segoe UI]I suggest you to send the suspected file (DeInter.ax) to VirusTotal first and give as a link to the results.

3

How do I do that? I’m not good with technology. Could you give me instructions how to do so?

4

Ok Nevermind I uploaded the file Deinter… ax

I Got this:
File DeInter.ax received on 2009.10.24 07:58:26 (UTC)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 4/41 (9.76%)
Loading server information…
Your file is queued in position: 2.
Estimated start time is between 50 and 71 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they’re generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click “request” so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
a-squared 4.5.0.41 2009.10.23 -
AhnLab-V3 5.0.0.2 2009.10.23 -
AntiVir 7.9.1.44 2009.10.23 -
Antiy-AVL 2.0.3.7 2009.10.23 -
Authentium 5.1.2.4 2009.10.24 -
Avast 4.8.1351.0 2009.10.24 Win32:Trojan-gen
AVG 8.5.0.423 2009.10.23 -
BitDefender 7.2 2009.10.24 -
CAT-QuickHeal 10.00 2009.10.24 -
ClamAV 0.94.1 2009.10.24 -
Comodo 2711 2009.10.24 -
DrWeb 5.0.0.12182 2009.10.24 -
eSafe 7.0.17.0 2009.10.22 -
eTrust-Vet 35.1.7082 2009.10.23 -
F-Prot 4.5.1.85 2009.10.23 -
F-Secure 9.0.15370.0 2009.10.22 -
Fortinet 3.120.0.0 2009.10.24 -
GData 19 2009.10.24 Win32:Trojan-gen
Ikarus T3.1.1.72.0 2009.10.23 -
Jiangmin 11.0.800 2009.10.24 -
K7AntiVirus 7.10.878 2009.10.23 -
Kaspersky 7.0.0.125 2009.10.24 -
McAfee 5780 2009.10.23 -
McAfee+Artemis 5780 2009.10.23 -
McAfee-GW-Edition 6.8.5 2009.10.24 -
Microsoft 1.5202 2009.10.24 -
NOD32 4537 2009.10.23 -
Norman 6.03.02 2009.10.23 -
nProtect 2009.1.8.0 2009.10.24 -
Panda 10.0.2.2 2009.10.23 Suspicious file
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.24 Medium Risk Malware
Rising 21.52.51.00 2009.10.24 -
Sophos 4.46.0 2009.10.24 -
Sunbelt 3.2.1858.2 2009.10.24 -
Symantec 1.4.4.12 2009.10.24 -
TheHacker 6.5.0.2.051 2009.10.22 -
TrendMicro 8.950.0.1094 2009.10.24 -
VBA32 3.12.10.11 2009.10.23 -
ViRobot 2009.10.23.2003 2009.10.23 -
VirusBuster 4.6.5.0 2009.10.23 -
Additional information
File size: 159744 bytes
MD5…: c2e2313245ed59e7eef8bfe990f84c1e
SHA1…: 66db125c187b5bcd189b320d25d2c3d0ff0a5e99
SHA256: 68623aef80bfecb85954d485af385e0d9b0bc9d3fc0797a5634a04ada71c0b9f
ssdeep: 3072:WIh4P2aiy9KZ46VEO3i8YpbfalSJrLCuJ4vBSbqYfusoEzNwT7EUy480E:q
OaJsBPSJrLDCS7fuskTy48
PEiD…: -
PEInfo: PE Structure information

And someone tell me what it means? 4/41?

5

[font=Segoe UI] Thank you for your time to submit the file.

Based on the results, it appears to be False Positive. Please send the sample false positive to virus@avast.com zipped and password protected with the password in email body.

For the meantime, you may add the file in avast’s exclusions list by:

1 Copy this: C:\Program Files\Roxio\ Roxio\ MyDVD Basic v9\VideoCore 9\DeInter.ax
2 Double click avast! tray icon
3 Click Details…>> then click Standard Shield
4 Click Customize then click on the Advanced tab
5 Click Add and paste the location in the “Modify Path” textbox
6 Click OK

6

Hm, how would i put something in a zipped file and it being password protected? And what exactly is a false positive? Does this mean I shouldn’t fret because I’ve been restless about this.

7

[font=Segoe Ui]A false positive occurs when a test incorrectly gives a positive result. A false positive is commonly a mistake in detections due to file architecture or behavior (avast 5 will be having behavioral based detections soon) that is similar to those of a virus.

For zipping a file, you may follow this steps:

1 Download 7-ZIP here
2 Double click the installer to proceed with the installation
3 After the installation, please head to C:\Program Files\Roxio\ Roxio\ MyDVD Basic v9\VideoCore 9
4 From there, right click on the file DeInter.ax and hover to 7-zip > click Add to archive…
5 A window will appear, please fill in the Enter password and Reenter password field then click OK
6 Wait for compressing process to finish until you get the output file with a .7z extension
7 Send the output file to virus@avast.com (Don’t forget to put the password in the e-mail body)
8 That’s it. Thank you very much for helping improving avast’s detections

8

I put in a password and stuff for the 7z, but where did it go afterwards?

9

Also, after I found this out, I did a system restore yesterday setting it back to the 20th, am I in trouble? I have yet to find any other problems other than the one in Roxio.

10

[font=Segoe UI] Its in the same folder as DeInter.ax, it is probable that the filename of the 7-zipped file would be VideoCore 9.7z, unless filename is modified. Please attach that file on an e-mail with the password of the False Positive in the e-mail body.

Also, after I found this out, I did a system restore yesterday setting it back to the 20th, am I in trouble? I have yet to find any other problems other than the one in Roxio.

[font=Segoe UI] Does avast still detect DeInter.ax after the system restore? Please report any related problems after the system restore.