Need Help With Trojan!

Viruses and worms
1

Hi. I am brand new to this forum. Two days ago I ran a thorough avast scan of my hard drive. It found one file with ’ win32: trojan-gen {other} ’ I had no idea what to do … it recommended to send it to the virus chest, so I did. I canot find any information on what to do now!
I am using Windows 98, my Avast version is 4.5, the file infected is EGDial.dll (dated 9/23/03), and is located in c:/ windows/system.
Looking in that folder, I see other seemingly related files. I have no idea what they are for. Any advice/information would be greatly appreciated!!!

2
  • Delete the file in the chest from your system
  • Run a full system scan with settings thorough and archive scanning enabled
  • If more infections are found move them to the chest.
  • Run Ad-Aware
  • Run Spybot s&d

Let us know the result when you’re finisched with this.

3

Hi Eddy
Thank you for your reply! I deleted the file directly from the chest and ran a thorough scan. Nothing showed up. Can you tell me about “Ad-Aware and Spybot s&d” … what are they and where do I find them? Also, where do these ‘viruses’ come from and how do I know if I need the file(s) they infect? How often should I run a scan? If it is updated daily, is that enough protection?
Again, thank you for your help!
Sarah

4

I run SpyBot Search & Destroy 1.3 along with Avast. SpyBot protects against, and removes, spyware…which is not a function that Avast performs. They’re separate issues. Eddy recommends using AdAware in conjunction with SpyBot, which many persons do, as one sometimes catches spyware that the other does not, and both are available for free. The combinatoin of SpyBot and AdAware is the only one I am sure, however, works well when running together. Some anti-spyware programs interfere with each other when run concurrently. Both SpyBot and AdAware free versions can be obtained from www.tucows.com.

5

I too have a similar problem to Newbe. I downloaded yesterday Avast. I have a trojan virus and when I try to put in chest I get message Access is Denied. Cannot process c\prog.files\saap exe.file.???
Also, when I get the box up with skull and crossbones…
there is no date and time of scan… which I have done several times. Help, am feeling very frustrated and stressed.
Never had a trojan before and don’t know what it is doing to my computer except perhaps slowing it down dreadfully?

6

Just run a boot time scan and let Avast handle it.
start Avast > Menu > Shedule boot scan

Please take some time to read the help, and stuff on this board to familiarize yourself with Avast and the settings/options

7

Eddy, thanks… I went into menu but boot scan is in red and not black so I cannot activate it? ???

8

Boot scan is only possible on NT based systems. If you have windows 98(se) or ME, run a full system scan with setting to thorough and archive scanning enabled in safe mode.

9

I am new here too…but been using avast for a couple years now I’ll try to copy the viruses I’m having a darn time trying to remove from my puter…when I click on “move” button when a virus or trojan is found…it never moves it…or if I try to "delete"it…it never does.At the end of my scan…when I scroll down to see if the virus or trojan got moved to the chest…it says “an error has occured”…and the virus or trojan keeps wrecking my puter…Is my download of avast coruppted or what?..I’ve tried installing a new download…and the same problem keeps happening.I’ve tried scanning with the “restore” fuction turned off…nothing is working…why is avast not moving or deleting this virus or trojan?.
c:\Doc &settings\Danny\on-line.exe.Win32T
" " \1.htl Win32T
" "\winsearchie32.exe Win32T

10
Is my download of avast coruppted or what?
Not likely, it looks more like a user error. Avast (and for that matter any malware removal tool) can only delete/move things if they are not in use.

If you have a NT based system (XP/2K/2K3/NT) run a boot time scan.
If you have 98(se)/ME, run a full system scan while in safe mode

11
Not likely, it looks more like a user error...... If you have a NT based system (XP/2K/2K3/NT) run a boot time scan. If you have 98(se)/ME, run a full system scan while in safe mode
I'm clicking on the "move to chest" button..how's that operator error? it's not being moved to the chest...and during a reguler scan..the scan just keeps going..last night I saw it scan 450000 files,according to the counter..I don't have that many files on my puter..I had to stop the scan..same thing occurs on a boot scan..it won't quit.... I'm running xp pro.
12
I'm clicking on the "move to chest" button..how's that operator error? it's not being moved to the chest
I ment to say that expect them to be moved, but as I pointed out Avast can only do that if they are not in use. Since you expected them to move and did not realize this (not knew this) I called it a user error. (I should have put that between " "s)
I saw it scan 450000 files
Don't be surprised if you do have them. Avast also counts files within archives. I cheched here and about 12.000 files per 1Gb used harddisk space is about normal. So if you have about 37gb used (give or take a few) 450.000 sounds normal. The amount of files scanned also depends on the settings you have when doing the scan. (thoroughly, archive scanning)

I suggest you run a full system scan while in safe mode and wait for Avast to finish.

13
14
I'm not using any file it has found infected.
You may not know the file is in use.

Look at it this way:
Malware is created to do damage to your system.
When can it damage your system?
Only when it is active ofcourse (in use)

how is the best method to run in safe mode
Since you have XP (NT based), use the boot scan.
15

I’ll give to a go…Thanks Eddie… 8)

16

HI EDDY
I found and dl the two programs you suggested and ran their scans. Now…what do I do with the results??? It seems rather confusing. Do I delete them? Which program should I delete them from?
AdAware found 233 critical objects (10 registry keys, 27 registry values, 195 files, 1 folder) and 31 negligible. The ‘families’ are: Alexa, EGroup dialer, Tracking cookies, Possible Browser Hijack attempt.
Spybot found about the same, I guess.
Please, if you would, explain what I should do. I have read so much information - still not sure. Spybot was the most confusing it seemed. Also, AdAware gave me the option to ‘quarantine’ and I chose that option … however there is nothing there when I clicked on it after the scan.
Any enlightenment appreciated!
Sarah

17

Ad-Aware : http://www.lavasoft.de/ from the left menu choose "personal "
spy-bot can be found at : http://www.download.com

18

Personally , with Ad-Aware , I delete everything that it finds.
If it found it , then it’s not suppose to be there !

Also , after you delete all that crap , run Spy-Bot and then imunize , this will keep the crap from getting back on your system.