win32: trojan-gen - What is it???

I know its something my old Norton Antivirus did never find.
But what is it? Should I be worried?
I’ve had it on my fileserver for a year or two, and probably only ran the .exe-file once, like a year or two ago.
Have I been running my network with a backdoor or someone spying on me for a year???

Dont find any info about it on Symantecs viruslist, and searching google doesn’t give much, so what is it really? What does it do?

Many thanks :slight_smile:

Hi Seb2,

The name ‘Trojan-gen’ tells us absolutely nothing about the malware concerned (appart from the fact that it is a Trojan, obviously).

We really need to know the name and location of the file avast! says is infected.

At a guess, I’d say it might be some sort of adware/spyware.

Do you use the usual anti-spyware programs such as the following?

Ewido (XP’Win2000 only) http://www.ewido.net/en/

 and/or a-Squared [url]http://www.emsisoft.com/en/[/url]

Ad-Aware: http://www.lavasoft.de/

Spybot Search & Destroy: http://www.safer-networking.org/

If not, give them a try. If you are still concerned, you could post a HijackThis! log for us to look at:

http://www.bleepingcomputer.com/tutorials/tutorial42.html

Many thanks :slight_smile:

Its in a keygen-file…
I’ve probably only run that file once, and since then its been backed up on my computers d: and on the fileservers samba-share.

I’m running Adaware now and then…the free home-version.

I’ve just switched to Avast (which looks like a great little free AV-program by the way).

Dont know if it said something else after “win:32 trojan-gen” or not, but I hope its in some log after this darn scanning has completed. Its still going on here…file after file…

But you dont think its something dangerous then? I’m usually behind a firewall (Sygate’s free version) but maybe firewalls dont stop trojans I dont know :S

Cant edit posts in here?

Just thought I’d add that I pressed “delete” since its a file I dont have any use for anymore. Not put in chest and no repair. Still there on my fileserver though, dont dare deleting it manually, will let Avast scan server-share later on too and delete it then.

A firewall will stop programs connecting out to the internet and sending out personal information or allowing a hacker to control your computer.

A Trojan horse is a program disguised as something you want (i.e. a program which generates a key allowing you to use a program for free) but is in fact something which takes over control of your computer.

(The use of keygens is of course highly illegal and immoral, as well as carrying the risk of Trojan infection, but you didn’t come here to be judged, I know. Just felt obliged to state that clearly.)

I don’t know if avast! detects keygens per se, or if the keygen was a Trojan horse. The best thing to do is to try the anti-Trojan program Ewido and see if it finds anything.

Yeah I know about the legal aspects…but I’m sure most people has sometime in their life needed a keygen for some reason :wink:

Now its finished scanning and it says in the log that it successfully deleted a “Win32:Trojan-gen {other}”

From what I understand this is not a name of a particular trojan, instead its something Avast dont recognice yet and put this general name on it (and a bunch of other similar trojans).

Nice to hear that my firewall ought to have blocked any nasty things it might have wanted to perform. Was so long ago I ran the file I dont remember what might have happened then, but I’m sure if the firewall said something I pressed “Block” :wink:

As long as its not a root-kit or something that has spread and disguised itself…but you dont seem to be all to worried for my sake so I hope its just some simple infected file that now is deleted :slight_smile:

Thanks for the help :slight_smile:

Ouch, Avast cant scan my fileserver :frowning:
I can browse the folders on it, but it gives me an error it cant find the path.
Its a BSD-server running Samba. Oh well, I’ll delete the file manually from there too, hoping the rest is ok.

Yeah I know about the legal aspects....but I'm sure most people has sometime in their life needed a keygen for some reason.

I couldn’t possibly comment. :wink:

From what I understand this is not a name of a particular trojan, instead its something Avast dont recognice yet and put this general name on it (and a bunch of other similar trojans).

I believe it’s something avast! recognises with a generic definition, i.e., a definition that applies to more that one Trojan, in fact a whole group or type.

As long as its not a root-kit or something that has spread and disguised itself.....but you dont seem to be all to worried for my sake so I hope its just some simple infected file that now is deleted.

If you want to be certain, you could run F-Secure’s Blacklight or SysInternal’s RootkitRevealer.