Help needed , Can't move Trojan to virus chest.

Viruses and worms
1

I received the following 2 alert and when I unable to move it to virus chest , delete it or repair it.

“Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\Installer\13376.msi\ISSetupFile.SetupFile1” file.

“Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\Installer\137d7.msi\ISSetupFile.SetupFile1” file.

                       Any advice on how I get rid of this Trojan?
2

With no google results on this file, it does seem suspicious.

Upload the file to VirusTotal and post results.

3

While I also got no results, the “msi” indicates Micro Star International. This company makes motherboards, video cards, etc.

Is your motherboard or video card made by MSI ?

If so, this might be a false positive.

4

The .msi is a MicroSoft Installation file, an archive file (not Micro Star International) which contains the suspect/detected file. The ISSetupFile part is Install Shield SetupFile and that name could be common to many applications as would the .SetupFile1 part.

I did a google search on both .msi file names and there are only a few hits, mainly this topic and some siteadvisor.com hits, which for a legit file I would say is low. So I doubt this is a false positive and should be uploaded to virustotal for further analysis as suggested.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

@ danaty
What reason/error was given for not being able to move the file to the chest ?
The reason I ask is it is strange that this file would be either a) in use or protected in some way (the most common reason for not being able to move it).

Unless of course you were in the process of installing a program (if so which was it as the .msi file names are very strange) ?
Then the .msi file would be in use and avast probably wouldn’t be able to extract the file from the msi file (possibly unsupported archive).

5

Thanks for the correction, David. :slight_smile: