false positive for "Process 1576, memory block. . . " trojan alert?

Viruses and worms
1

I regularly use the Avast “while screensaver is working” deeper scan.

I usually get no report.

For the last two or three days I received this message to welcome me:

A Trojan Horse Was Found!

There is no reason to panic, though. Try to follow the given advice and links.

File name: Process 1576, memory block 00xs01120000, block size 1310720

Malware name: JS:ScriptSH_inf [Trj]

Mawlare type: Trojan Horse

VPS version: 090528-0, 05/28/2009

I know enough about computer threats to know I don’t know much. But doesn’t this say “the Trojan Horse is in an ongoing Process in computer memory, and not in a file?”

If so, how do I get rid of it? I’ve restarted computer several times.

Only strange thing I’ve noticed is media players seem to have a more difficult time playing DVDs than before, but I attributed this to general quirkiness.

Should I start the long work-up I seem to need these days in order to hit a nice, full panic?

Or just click the “Don’t show this dialog next time” box and figure that if nothing else shows up bad, everything’s as good as it could be. . . ?

Thank you

2

Hi Vagabundus ,

First try a boot time scan with avast! if your OS allows it. Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested. (Or open the tab at the top left of the scanner screen and select the boot time option from there.)

Try one or more of the usual free adware/spyware scanners.

SUPERAntiSpyware Free
Malwarebytes’ Anti-Malware
a-Squared Free
Spybot Search & Destroy

Download, install and update the programs.

Always select the option to quarantine any malware found rather than delete it, then you will be able to restore files or registry entries wrongly identified as malware- a rare but not unknown event for any malware scanner.

When you have finished, scan for out-of-date and insecure software using Secunia Online Software Inspector (OSI) and update any vulnerable software: this will help to prevent future infections.

Most importantly, follow the advice here:

 |
 |
 |
 |
 |
 ˅