Two trojans detected by Avast 4

Windows XP (Home) SP2, Avast 4, VPS 080526-0

After updating Avast’s virus definitions and during a subsequent thorough scan of my system this morning Avast detected two Trojans on my computer’s c:\drive.

The first was an .exe file located on my desktop in a folder I named “Security Tools”. The program file was called Fixwareout.exe. Avast has identified it as "Sign of Win32:Neptunia-VQ [trj]. I have quarrantined the file.(this file is a valid removal tool for specific types of Malware)

The second was located in:
C:\Program Files\CommonFiles\Wise Installation Wizard\WISCDDCBBF1270346BC938BBCC81A1EEAAA_4_0_0_1154.MSI
This was identified as a SUPERAntiSpyware installation file. I tried to quarrantine this file as I had with the previous one but it failed.

I last completed a thorough scan of my system two days ago and the system was clean so either these two items have been introduced since then or they are false positives with the latest Avast definitions.

Thank you

Sorry I forgot to mention that the second trojan identified by Avast was:

Win32: Trojan-gen {Other)

Well fixwareout.exe may contain some signatures for what it is searching for to fix, perhaps it is that which is being detected, a problem with tools, avast doesn’t know what it will be used for. I have a folder on my HDD for tools such as this and samples D:\excludes (original I know) and I exclude that from scans.

Add D:\excludes* the asterisk is a wildcard so you don’t continually have to add new files to the exclusion lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions

If the .msi file does belong to SAS it is a strange looking installation file one I don’t recognise with the recent versions of SAS.

You don’t say why the move to the chest failed, probably because the file size exceeds that for the chest. Program Settings, Chest, here you can adjust the maximum file size to send. How big were they ?

Hello David, Thank you for the information regarding the “Fixwareout.exe” file

The SAS .MSI package was recently installed and is a Windows Installer Package (Windows® installer)located in C:\Program Files\Common Files\Wise Installation Wizard. The size of the file is 4.36 MB

Sorry I forgot to say that several other people in a group I belong to that are using Avast have reported the same detection today Win32: Trojan-gen {Other} with SAS. The Msi package may because the download was done using Firefox.

Yes there are a few topics on the forum relating to SAS FP (see http://forum.avast.com/index.php?topic=35821.0), it doesn’t happen with the latest version of SAS, so an update is suggested, it uninstalls the old program before installing the new.

There is also going to be a correction to the next VPS update which should also resolve it, but I would still recommend that you have the latest version of SAS.

I do my download via firefox and mine is usually an .exe not .msi installer, I guess it depends on where you downloaded the program ?

Hey i am new in this, and recently before i got avast, it seem like some virus got into my system before installing the avast antivirus. When i did a boot scan, numerous trojan horse virus have been found in C:\WINDOWS\system32 folder and when i select repair, it said that the viruses cannot be repaired. the viruses have total control on my computer, it even restrict me from performing certain task. for example cant view add or remove programs and view my files properties. I NEED HELP URGENTLY.

Do not post twice the same… just double the effort of help.
Follow http://forum.avast.com/index.php?topic=35848

Thank you for your help david, I have uninstalled my SAS and D/L a new version and that seems to have done the trick, Avast is no longer detecting the trojan.

Thanks again for all you friendly and helpful advice and thank you for the Avast antivirus program.

George

No problem, glad I could help.

Happy that SAS is now working fine on your system.

Welcome to the forums.