Win32:Downloader-EXU [Trj]

Hi,

I launched a complete scan and a virus was found. I follow the indication - quarantine - and to be sure it was ok, I launched a new scan. Avast found a virus again, a new one ! Both are said to be a serious threat by Avast.
What do you think I should do? Do you think the first virus wasn’t store in quarantine but kind of mutated?
Both virus were identified as a Win32:Downloader-EXU [Trj]
The first was on C:\Dpicoa.exe
The second one was C:\SystemVolumeInformation\restore (a lot of numbers).exe

Thanks for helping!
Pat

It is likely that the act of moving the first to the chest caused system restore to create the second infected restore point that was subsequently detected.

In any case I doubt that anything escaped from the chest:
You have done the right thing, ‘first do no harm’ don’t delete, send virus to the chest and investigate.

There is no rush to delete anything from the chest, a protected area where it can do no harm. Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.

A google search for this file name returns only 2 hits, one of them this topic, which is suspect for a .exe file in the C:\ drive.

  1. If you are on a 32bit system run a boot time scan with avast…
  2. Run Free Mbam (update it before): http://www.malwarebytes.org/mbam.php
  3. Post your results.
    asyn