I got 52 Trojan Horses?

Viruses and worms
21

Hi Tech,

I’m new to this forum and I apologise for raising this question below (but I don’t know how elese to get my question to you).

I run home windows xp (service pack 3 is in) and i have upto date home edition avast. my windows security centre shield is saying that i have no virus protection. I tried your solution which you posted on september 10, 2006, rebooted twice & the shield is still there (saying i have no antivirus).

do you have any suggestions?

thanks so much

regards
hektor

22

hektor, check: http://forum.avast.com/index.php?topic=23457.msg193534#msg193534
and http://windowsxp.mvps.org/repairwmi.htm

23

Hecktor
for some background see this thread
http://forum.avast.com/index.php?topic=37637.0

24

To know if a file is a false positive, please submit it to VirusTotal and let us know the result.
[/quote]
What would you guys need to see from that screen in virustotal? I had a hard time figuring out what it all meant.

thx - cpr

25

Click in the ‘archive’ button and browse for the file you want to upload/scan, click to continue… the scanning results will appear, one by one…

26

Please pardon my ignorance, but “Archive” where?

thx - cpr

27

In Portuguese, arquivo.
In English, file.
Sorry, I’ve mess the words archive and file.

28

So what information exactly do I need to post here? Do I cut/paste every detail of every result for every file scanned? that’s my question. Is there some way to just post the results (like a quick & concise list) of what virustotal shows me? If there is, how do I do it.

As I said before, I’m new to this, so I think I may missing something in these steps. Basically, all virustotal tells me is what I stated in my earlier post. (Avast! is the only engine in all of virustotal that sees these as trojans.)

Lastly, if these aren’t trojans, how do I get them back into operation so we can play games again? (in other words, out of the chest?) I’ll go back and re-read this thread and make sure I’m not missing something.

thanks again for all the input here -

thx - cpr

29

In your browsers address bar, just copy and paste the URL for the page with the VirusTotal results in the forum.

From the chest you can restore files, but simply doing that will have them detected again so you have to report them to avast for correction and exclude the files from scanning, etc.

So if it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

30

Here’s a couple:

http://www.virustotal.com/analisis/b63a79725f3ef0f1bbe6f4f30eacce5d
http://www.virustotal.com/analisis/9bfff859a60f0927d81460dfa8806296

It’s not seeing this one as a trojan anymore -
http://www.virustotal.com/analisis/c5b2039d007a6d38c7ebd5443b1c3e89

I’ll post more later -

thx - cpr

31

It isn’t unusual for a VT scan not to show an avast detection as their signatures aren’t updated in real time as the users are.

So these first tw0 appear to be false positives as the only detection is also a generic one, which is more prone to false detection. The third also as there are no detections, considering what I said about the VT signatures avast would be the only detection.

So what next:
a) rescan these files in your suspect folder or in the chest.

b) if they are still detected, send samples to avast, restore from the chest (you will initially get an alarm choose no action).

c) exclude the file in its original location as outlined in the ‘how to report it to avast and what to do to exclude them’ link above.

d) if they aren’t detected (the false positive my have been corrected already), no need to submit to avast, restore the files from the chest, delete the copy from the chest when you confirm a copy is in the original location.

32

Things seem to have cleared up quite a bit, and are running more smoothly, if a bit slow.

I wanted to ask Polonus about this, but I"ve been busy for the last two weeks.

Okay, so I clicked on the first one, and I get a warning that it’s an unknown publisher. Kinda scares me - what does that mean? I assume it’s safe to run? When I click on the second one, it’s mostly foreign. I assume it’s safe as well?

Also, I’ve never run a backup on my computer. I had heard that Windows does it automatically. So, I know I sound naive, and since I’m here, I’ll ask - how do I run a backup?

thx - cpr

33

those programs should be fine folks here use them a lot
I like CCleaner
your choice

windows do automatic backups?
to where?

good to hear from you
everything ok?

34

Okay - now I trust them. Getting an “unknown publisher” message was new to me. I’ll try the CCleaner.

Backup: I heard that somewhere, but didn’t know what, when, where, why, or how. I’ll figure it out, I need to start doing it more often. (Friends have done it for me before.)

Everything is going okay here, we’re back to school, back from a trip, taking over a boy scout pack, and a few other things, so we’re a little busier than usual.

Thanks for all your help, everybody. I’ll report back on the CCleaner cleanup.

thx - cpr