virus in C:\WINDOWS\system32\dssenh.dll ?

Viruses and worms
1

Hello all,

During my last boot time Avast scan on my laptop, that took place last night,
I had the following detected :

C:\WINDOWS\ServicesPackedFiles\i386\dssenh.dll : Troj-gen {Other}

I choosed to quarantine that file (option 5), despite the extra warning message.

Later on, I had the same message on the same file name, but in an other location :

C:\WINDOWS\system32\dssenh.dll

I haven’t decided what to do with this file yet (I am presently writing this post from my PC) :
the scan is just left as is on the laptop. As I had received the extra message warning me that
the file is within windows, I suppose I might have problems during reboot if I quarantine this file,
so I am just waiting your advice about what to do now. According to some info I could grab in
this forum, this detection could be an FP ?

The last virus data base version on the laptop might be : 090425-0 (received just before I started
the scan), received on my PC this morning.

So, my question is : how to terminate safely my scan on my laptop ? Can I restore the quarantined file
(as long as I can reboot) ?

Many thanks in advance for your help.

2

This should be fixed now.Avast should no longer detect this as a threat,which means you can restore the file.The file is not critical

http://forum.avast.com/index.php?topic=44557.msg373172#msg373172

3

Thanks, Micky77

So I ignored the second detection, and the scan completed normally. The file has been restored,
all seems to work well. The database level was 090425-0, which at that time looks still to be the
last one. So at next VPS release there should be no more detect, well, I hope :wink:

4

If you have, and I quote "
please update to new vps (090425-0), this false positive has been just fixed and released."

There should be no detection.If you have updated to vps (090425-0) and are still detecting a virus you should post back immediately.

5

OK, I have just planned a new boot time scan, which is currently running now on my laptop.
But there will be no feedback from me until late this evening, as I have to go away until then.
It is possible that the last VPS update just came up after the time the preceeding scan was
planned (a matter of a few seconds …)

6

Hi, Micky, I am back now.
The scan completed normally, without any more extra message. To be more sure, I tested the
suspect dssenh.dll file directly from the quarantine box, no message.
So this detection is definitively a FP, resolved by the 090425-0 VSP version. Sorry for my blunder,
and thanks for your help. :slight_smile: