Hi. Recently, I downloaded WinRAR to extract some .zip files. I use avast home edition, spybot search & destroy, a-squared free and ad-aware to make sure i dont get infected, and run scans often to make sure things are ok.
This morning, after i updated all of them, I ran full scans and a-squared detected Trojan.Win32.Chifrax.a in a file named Default.SFX - the precise location was C:\Program Files\WinRAR\Default.SFX
Avast didnt detect anything so far, so I just put it in a-squared’s quarantine. I also googled it to see what i could find: according to ‘Monthly Malware Statistics from Kaspersky Lab: April 2009’, “Trojan.Win32.Chifrax.a dropped out of our ranking last October but has now returned and gone straight in at number four. This Trojan, like RaMag.a, is a modified WinRAR archive, which in this instance is a self-extracting archive”.
I couldnt find much more info - such as removal steps and what exactly this possible virus can do.
Could someone help me find out if its a false positive? And if its not, how can I remove it properly?
Well a-squared has a bit of form on false positives and this certainly looks that way. Report it to a-squared, personally I would suggest replacing it and adaware (a waste of HDD space) with another anti-spyware application.
If you haven’t already got this software (freeware), download, install, update and periodically run them.
MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later. - 2. SUPERantispyware On-Demand only in free version.
Okay, thanks. I downloaded those and ran scans, nothing…
Anyways, could someone take a look at my Hijackthis logs? thanks in advance!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:56:32, on 9/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20627)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\ARQUIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Arquivos de programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Arquivos de programas\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Arquivos de programas\a-squared Free\a2service.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Arquivos de programas\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Arquivos de programas\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Joao\Desktop\HiJackThis.exe
-= Some other things to consider:
(1) XP SP3
Windows Update for Windows XP’s service pack 3…
(2) No firewall process detected…
A better firewall would probably solve the problem… Windows XP Firewall has no outbound protection…
(3) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
Seems to be deactivated already…