Win32:Small-VR [Trj] and Win32:Haxdoor-BK [Trj]

Viruses and worms
1

Hello there,

I am very new to this and not really a computer wizz so if anyone is kind enough to respond please leave message in plain English!!!

I have had a warning come up that computer had a virus. The computer restarted and scanned the whole system before opening windows normally. It asked me options and as Cleaning didn’t work i put the viruses in the chest.

My question is what do I do now??
They have been there about a week and the only thing that seems not to work properly is the logging on to the internet, the only way this can be done is opening the status box and click connect. Apart from that everything seems fine.

Virus 1:

Virus has been detected!
File Name: qz.dll
FileID: 7
Virus Description: Win32:Small-VR [Trj]
Scan files in the temporary folder: C:\DOCUME~1\ben\LOCALS~1\Temp_avast4_\unp55361675.tmp
C:\DOCUME~1\ben\LOCALS~1\Temp_avast4_\unp55361675.tmp\7.dll[UPX] Win32:Small-VR [Trj]

Virus 2:
Virus has been detected!
File Name: mmx464.sys
FileID: 10
Virus Description: Win32:Haxdoor-BK [Trj]
Scan files in the temporary folder: C:\DOCUME~1\ben\LOCALS~1\Temp_avast4_\unp51516038.tmp
C:\DOCUME~1\ben\LOCALS~1\Temp_avast4_\unp51516038.tmp\10.sys Win32:Haxdoor-BK [Trj]

Virus 3:

Virus has been detected!
File Name: A0014637.dll
FileID: 8
Virus Description: Win32:Small-VR [Trj]
Scan files in the temporary folder: C:\DOCUME~1\ben\LOCALS~1\Temp_avast4_\unp235499312.tmp
C:\DOCUME~1\ben\LOCALS~1\Temp_avast4_\unp235499312.tmp\8.dll[UPX] Win32:Small-VR [Trj]

I have the names of the files below and the original location, hope this helps.
Please could some let me know if these are new? if it is OK to delete them? If I go on the internet is everything still going to be OK? and should I inform people of the virus as can not clean with Avast.

Look forward to your responses

Kind Regards

Ben Geary

2

You just scanned unpacked files that were previously unpacked by avast!. It’s ok to delete them, though i have no clue why they were left there. Alwil guys will probably know more on why they were left there…

3

:slight_smile: Hi Ben :

 "(Trj)" stands for Trojan, which is not really a "virus";
   assuming your Operating System is either Win 2000 or
   Win XP, we usually recommend the good & FREE "Ewido"
   from www.ewido.net/en to detect & remove trojans,
   worms, keyloggers, generic dialers and things like that .
4

Hi Ben,

Here for the technical info on aforementioned trojans:

http://www.sophos.com/virusinfo/analyses/trojbanksnifa.html

http://esp.sophos.com/virusinfo/analyses/trojhaxdoorbk.html

polonus

5

Guys,

Thank you so much for your help will use the programs you suggest.

I seem to be having a nightmare at the moment with my computer!!

Well will keep you informed of how I get along!!

6

:slight_smile: Hi Ben :

 We made these suggestions 6 weeks ago ! Why have
 you waited until now ?
7

Sorry thought the replys would get sent to my email.

Only happened to check here today as seem to have collected a few more Trj’s!!!

Are they viruses? or can I delete them with out mucking up my computer?

8

Check the profile button, Notifications and Email, Notifications of replies should be emailed to you, I believe that is the default setting, see image.

Are you referring to the previous detections or the latest rash ?
Deletion is never a good first option (you have none left) move to the chest and investigate ?

If they are the old ones and have been in the chest for 6 weeks without harmful effect, I think you can safely delete them from the chest.

[url=http://Only happened to check here today as seem to have collected a few more Trj’s!!!]Only happened to check here today as seem to have collected a few more Trj’s!!![/url]
Same drill as before:
What was the virus name, what was the infected file name, where was it found example (C:\windows\system32\infected-file-name.xxx) ?
What actions have you taken (response to the alert) to try and resolve the problem ?