TROJAN being reported since update

system · 2006-11-05T19:34:42.000Z

I keep getting alerts re: win 32. HAXdoor-GJ [Trj]. I click to send it to CHEST, but no infected files ever show up there. Can anyone help me respond to this?

Thanks

jcchev

system · 2006-11-05T21:04:51.000Z

I’m getting Win32:ShareAll-H as a Trogan. Since there has been a rash of false positives since the latest update I’m just going to sit on it for a while and do nothing.

DavidR · 2006-11-05T21:10:45.000Z

I have answered (rather asked a number of questions) in your other post http://forum.avast.com/index.php?topic=24626.msg202421#msg202421, created 2 minutes before this one.

Can you answer them here as you original post in someone else’s topic isn’t really related to it.

Well you can start by saying what is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ? What avast! version and VPS file (virus database) number, e.g. 0645-4 (see about avast!) ? You say nothing shows up as infected in the chest - How are you accessing the chest ?

Welcome to the forums.

For the future, please don’t make multiple posts about the same question, it only creates confusion and duplication of effort for those helping. Posting in someone else’s topic should only be done when your problem exactly matches that topic and then it may just be best to monitor the topic only posting if you need additional help.

@ Testy,
The same is true of this case, your post seems totally unrelated to this a different malware detection. Don’t sit on it check it out and if need be create your own topic answering the first question above and why you might think it is an FP.

system · 2006-11-06T00:11:05.000Z

Sorry for the double post. THis was my first time on the forum and I was having trouble finding my way around…

I use Avast 4 Home Edition…I’m running a scan now and cannot access “about avast” but I downloaded the latest version this a.m… The file name of my Trojan is: win32Haxdoor-GJ[Trj].

I accessed the Chest by clicking on the “Send to Chest” button as instructed in the alert box from Avast. Nothing shows up as an infected file.

Thanks…

DavidR · 2006-11-06T01:03:48.000Z

I repeat, what is the infected file name (you have told us the trojan name already and isn’t that helpful), where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?

You aren’t accessing the chest, just instructing avast to send it to the chest. To do so you need to open the Simple User Interface, as you would do to run a scan, right click or select the menu and then click Virus Chest. You will see it comprises several sections, the one you are interested in is Infected Files. There is a System Files section that contains some back-up copies of important system files in case the original is infected, don’t worry about these.

system · 2006-11-06T04:03:43.000Z

I gave you what I thought was the file name and, yes, I thought it was helpful. And, yes, I did go into the Chest and I saw exactly what you describe. When I clicked on “infected files” it showed nothing.

alanrf · 2006-11-06T05:49:52.000Z

Where angels fear to tread …

jcchev,

don’t worry too much about the double posting - we were all new here once (and I recall thinking I was being treated as an idiot - maybe because I am … oh well).

In this post, at least, you have told us about the reported name of the virus but you have not told us the name of the file that is reportedly infected. David is asking for the file that is reported as infected and not getting the information - it may be that you have reported it in another thread but it would help if you could report it here.

DavidR · 2006-11-06T12:51:56.000Z

If nothing is showing up in the Infected Files section of the chest, then the send to chest function is failing, are you getting any errors ?

The move to chest may fail for a number of reasons, the location of the file, commonly in the system folders, or they are in use and as such protected by windows. This is why it is important to know the file name of the file infected with the win32.HAXdoor-GJ Trojan and where that file is located.

If there is nothing in the chest to give this information, try the avast! Log Viewer, right click the avast icon and select ‘avast! Log Viewer,’ check the Warning section of the viewer, it should contain information on virus detections.

system · 2006-11-06T14:01:30.000Z

Well, as it turns out my Trojan was in an email in my “deleted” folder. By simply deleting it my new avast scan was clear.

Thanks. I sure like this product. I searched for months to find the right mix of protection before I finally settled on Avast, Ewido, Spybot and Zone Alarm (firewall), CCleaner and RegMechanic. They all work well and very well together.

Thanks, again…

DavidR · 2006-11-06T15:13:37.000Z

The location, in the deleted emails folder would likely cause the move to chest to fail. email folders are a trick, it isn’t a folder at all, but a database file. It stores many emails inside it so it is difficult and often impossible to just extract an infected email from the file without corrupting the database file, possibly losing other emails in that file/email folder.

This on occasion results in the only option deletion of the database file with the loss of all email in that folder. So it is important not to use your inbox for general email storage as the inbox is often the one infected or open at a crash, etc. causing its coruption and loss of emails.

system · 2006-11-06T21:03:39.000Z

that’s helpful info. Many thanks… Seems like I’m back to normal now…

DavidR · 2006-11-06T23:57:24.000Z

Your welcome, glad we could help.

Announcements