Win32:trojan gen, {VC}

Avast Free Antivirus / Premium Security
1

Just want to report in with this one in case anyone else has had problems with it.

It tried to launch when I booted up this evening and Avast! spotted it at once but couldn’t delete. After several attempts at scanning and trying the various options of Repair, Move to Chest etc I scanned in Safe Mode with System Restore turned off and Avast then managed to delete it properly.

I’ve run more scans after rebooting in normal mode to ensure that the file really has been fixed, which it has - it was in My Documents and trying to launch from there as the system booted up my folders into the virtual memory, which was why the alarm went off.

You guys rock, I wouldn’t have known how to do any of this if it hadn’t been for all your help:)

Just wanted to reassure people that scanning in Safe Mode and deleting the infected file via Avast with the delete on next bootup option checked seems to have worked with this particular virus, however I do not know what would have happened had it got into my System files. I’d probably have had to delete the file manually.

2

I to have this Virus on my computer and it never seems to delete it properly, so i never know if its still on the pc!

3

Are you using the VPS version 0443-0 or 0443-1?
If 0443-0, please update to 0443-1 and retry.
There were some false positives with the old one :wink:

4

I have updated my version to the latest, and its ironic that I just got that same Virus about 10 minutes ago from a site called www.ilovebees.com. It was in my history and I have never heard of it before so i checked it out. Even thought im using Firefoz which is ment to be better.

5

Have you tried turning off System Restore, booting into Safe Mode and scanning in Safe Mode? That’s what I did.

Also can you look in your Logs and find the pathnames for the infected files? If they’re in your System folder Avast probably won’t be able to deal with them itself but the chaps here might have solutions to help you.

This thing was actually piggybacking itself on top of a .exe file I had saved in My Documents and was giving the file the extension of /setup.exe so I had the .exe file for Ace FTP Freeware calling itself aceftpfree.exe/setup.exe.

I was using the Avast version of 19th October then it updated late last night so I’m going to scan again tonight to be safe.

6

Oh and yes Avast kept saying invalid file path name when I tried to delete from the computer in normal mode, it was only with System Restore turned off and running in Safe Mode that I managed to get rid of it.