Win32:Small-FU [Trj]

Viruses and worms
1

???My avast! scanner has alerted me that 4 files have been infected with Win32:Small-FU [Trj] This happened over a 12 hour period of alerts popping up on the computer. The files infected are 3 WINNT\system 32 files and one System Volume Information_restore file. The recommended action was to move them to the virus chest, so I did. AVG scanned and did not come up with anything. The virus chest info shows the last changes to these files were back in July of 2004. I’ve been running Spybot Search and Destroy & Ad-Aware, and I recently downloaded SpywareBlaster. I’m running IE and OE on WinXP. What do I do from here?

2

Just search the board for Win32:Small-FU [Trj].
They are Outpost Firewall false positives.

Welcome to forums 8)

3

Nothing comes up except this topic. I tried searching before I posted. A false positive is OK?

4

Maybe my mistake… but here there is some info http://forum.avast.com/index.php?topic=19535.0
False positives are not virus or malware, just detected as being so.

To be sure, the better will be test the file against on-line scanners. Submit the file to Jotti or Trendmicro or Virustotal.

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus (at) avast.com.
Give a brief outline of the problem, the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see About avast: right click avast icon) will also help.

5

I don’t think hey aren’t outpost pro related FPs as the file location doesn’t indicate the Outpost Pro folder (rather the system folder), plus ‘twinmom’ doesn’t mention using Outpost Pro.

So best to check the files at Jotti, etc. as mentioned.

If you also have AVG installed, having two resident AVs can cause conflict and the latest version of AVG does cause conflict as Tech can confirm.

6

They’re could be incompatible if the two residents are running (or even installed) at the same time.
If AVG is the second, non-resident scanner, no trouble.

7

Thanks Tech, not wanting to hijack the thread, but I’m interested to know how do you set up AVG to act as non-resident (it might also help ‘twinmom’) back-up scanner ?

8
  1. Install avast. Boot. Setup all providers as you want/need. Update, etc.
  2. Boot
  3. Install AVG using a customized install and NOT INSTALLING any resident (not even for the email, or Outlook, etc.).
  4. Boot
  5. You can set the AVG services to manual to reduce resources use. You can set AVG Control to not alert about the absence of residents, etc.
9

Thanks Tech, that may well be useful for others in the future and has satisfied my curiosity.

10

Welcome to the forums, twinmom1969! :slight_smile:

The fact that twinmom1969 had 2 resident av programs running is most likely why the infection occurred.

Twinmom1969 - runnning 2 anti-virus programs (other than as Tech explains above) is not better protection but is in fact less protection. This is because the 2 programs will conflict with each other. Therefore, your computer gets infected because neither program can properly give the protection needed.

If you have been able to move the 4 infected files to the Avast Chest, you can leave them there as they can do no harm from inside the Chest. After a few weeks and if you have no adverse effects (windows or other programs not running correctly), then you can re-scan them while they are in the Chest. If they are clean, they can be restored. If they are still infected, you can then delete them perminately.

I hope this helps you. :slight_smile:

11

Thanks for the help! I’m going to try the suggestion about AVG. They’re in the chest so I’ll leave them there for a while. Thanks a bunch!

12

Just to make clear.
I’m not saying to run two antivirus, residents, at the same time.
The second is not for protection but to analysis, comparison, fun ;D

13

Right … thanks for clarifying that, Tech! :smiley:

14

I have this virus in file c:\WINDOWS\SYSTEM\in9bDs.dll. I can only start in safe mode and when I try to move it to the chest, I get the message that the RPC (or was that RBC) file is not available (or something close to that). I can’t open in normal mode and I can’t get online. Can any one help me?

15

Never mind. Avast! successfully repaired it, AGAIN, but this time I shut it down, unplugged it and walked away for a cooling off. Rebooted and all was normal (?). I’m still glad this forum is here :smiley: