HELP  i can't remove Win32:Banker-BHX [Trj]

system · 2007-01-25T00:25:05.000Z

i’ve opened my e-mail, then avast! warned me of Win32:Banker-BHX [Trj] and i can’t remove it… it seems to be disguised and i can’t remove it manually
C:\Documents and Settings\Yutan\Configurações locais\Temporary Internet Files\Content.IE5\T78IC42U\orkut[1].exe[YodaProt]

system · 2007-01-25T01:20:18.000Z

Hi Mymn - welcome to the forum.

Try clearing your temporary internet files and the running an avast! boot scan.

DavidR · 2007-01-25T01:21:29.000Z

I assume your email is web-based, e.g. you view it through your browser, otherwise it shouldn’t show up in your Temporary Internet Files ?

If that is the case, then I can’t understand why the Web Shield didn’t detect and stop it before it got to your Temporary Internet Files.

Is the Web Shield enabled ?
What is your operating system ?

If you have XP or Win2k, you could enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, Menu, ‘Schedule boot-time scan…’

Lisandro · 2007-01-25T11:45:54.000Z

Mymn post:1:

i’ve opened my e-mail, then avast! warned me of Win32:Banker-BHX [Trj] and i can’t remove it.

When did you install avast? Before you’ve received that email?
Which is your email program?
Which is your avast version, virus database (VPS) version and when did you ‘receive’ that email?

DavidR · 2007-01-25T13:53:28.000Z

Tech post:4:

DavidR post:3:

I can’t understand why the Web Shield didn’t detect and stop it before it got to your Temporary Internet Files.

Mymn post:1:

i’ve opened my e-mail, then avast! warned me of Win32:Banker-BHX [Trj] and i can’t remove it.

Quoting part of my sentence without the reason I couldn’t understand it is taking it out of context and following it with Mymn’s quote makes it appear I didn’t see or understand what Mymn had posted.

DavidR post:3:

I assume your email is web-based, e.g. you view it through your browser, otherwise it shouldn’t show up in your Temporary Internet Files ?

Far from it, if Mymn was using a pop3 email client, then opening it shouldn’t result in a detection in the temporary internet files folder. If the email was web based email then it is entirely possible it would appear in the temporary internet files, in which case I would have hoped it was detected by the web shield and not as it appears by the Standard Shield.

I guess we will have to wait for some answers from Mymn.

system · 2007-02-26T17:50:21.000Z

Got the same problem!!!

here it is; Got infected by msn messenger with a link that appeared saying …check out my new website blablabla… thought it was my friend who wrote it, so I clicked on it, and bang!!!

Trojan… deleted all the files, and noticed that there was some avast files infected. After deleting everything i thought i was all good but can run messenger computer crashes and shut down. I deleted msn and download a new one… same problem… deleting avast cause had files infected and run Norton and a malicious removing tool from Microsoft without success still crashing…

Before crashing i had a message saying that the operating system is infecting!!! What does this mean? I know shit about PC, and im worried of losing everything here…

I reinstall avast now and will give it another shot but please HELP ME!!!

cheers.

FreewheelinFrank · 2007-02-26T18:43:32.000Z

Hi puchero,

Have you tried a boot time scan with avast!? Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested.

Try AVG Anti-spyware:

http://www.ewido.net/en/product/

And maybe a few online scans if you can get them to run:

http://support.f-secure.com/enu/home/ols.shtml

http://www.bitdefender.com/scan8/ie.html

http://www.pandasoftware.com/products/ActiveScan.htm

(Disable avast! before running online scans.)

Announcements