system
18
You said that it is a false alarm. The strange thing is that all the infected files have the same filelength. I compared the EXE-files to each other with dos-command “fc /b”. They are all the same.
Between the infected EXE-files and infected CLASS-files there is a difference of two bytes.
All the infected files were located in cache and temp folders. The cache and temp folders looks to me the best place for a trojan to hide.
Infected filenames:
Dc61.exe
Dc386.exe
99950062.exe
SecurityClassLoader.class-35b3d2a5-23a8bb2e.class
SecurityClassLoader.class-35b3d2a5-606607aa.class
SecurityClassLoader.class-35b3d2a5-6b11255e.class