Trojan win32:Host-GH and GZ

system · 2007-02-03T20:20:17.000Z

Hi friends and grettins from Spain !
Since a few days, my Avast, detects this two trojans:
Win32:Host-GH and Win32:Host-GZ, I send them every time to the trunk but they come back again and again…
I scan all my computer in safe mode and there is no infection, I scan it also with avg antispyware, spy bot and Spyware terminator… with the same result… ???
Could it be a false positive?
Am I really infected?
What do you think about this?
Thank you very much!

FreewheelinFrank · 2007-02-03T20:49:00.000Z

Hi José Antonio,

What is your operating system? Do you have a firewall, either Windows XP firewall or a third party firewall like Zone Alarm?

What is the name and location of the files detected?

If the files are in System Restore, you will need to delete the infected System Restore files. You can find information about how to do this by searching the forum.

Have you tried a scan for rootkits, for example with BlackLight?

http://www.f-secure.com/blacklight/try_blacklight.html

system · 2007-02-03T21:15:32.000Z

Hello avast, evangelist, and thank you for your help.
I have home here is the location of one of them: C:\DOCUME~1\JOSEAN~1\CONFIG~1\Temp\78exssd32a.2.exe[UPX]
the other trojan is in the same place, I think.
I have scaned with blacklight also and…nothing… ???
What I can do now ?

system · 2007-02-03T21:25:20.000Z

Hi Jose :

 Do you "delete" your "Temporary Internet Files" at least daily and/or your "Temporary Files"
at least bi-weekly ? If not, this would be wise. This can easily be done by using a Good & FREE
program called "ATF Cleaner" developed by antiSPYWARE Expert "ATribune" and is available
at www.atribune.org/content/view/19/2/  .

system · 2007-02-04T06:22:34.000Z

Thank you, again, I have cleaned it with this very good program!

system · 2007-02-05T10:00:08.000Z

Hello, first of all I want deeply grate to all avast developers for this beautiful anti-virus , the best I never have had !
Finally I could localize my trojans than came again and again.
I scan with Sygate on line test anti-virus, the location was in my temporary files in the local configuration hidden folders.
The name of this trojan is webus
First I delete your start order in the start programs windows options.
And then simply delete the 5 files infected detected by Norton, then I cleaned all the orders in the registry, there are a very good instructions in internet.
I don’t like Norton, I had a lot of problems with this so heavy program.
My question is… why Avast only could detect this trojan when was running and no in the base infected files, like Norton had ?
I repeat, I’m very grateful and happy with avast, I only want contribute to improve it.
Thank you.

Announcements