win32:trojan-gen

Viruses and worms
1

HELP!!!

Everytime I run avast it tells me I have a virus, win32:trojan-gen. Avast can’t seem to move it to the chest or delete it. I’ve run avg, malwarebytes and trojan killer and they can’t find anything. Is this a false positive? Do I need to be concerned?

2

1.clear your temp fileshttp://www.piriform.com/ccleaner
2.do a dr.web cure it scanhttp://www.freedrweb.com/cureit/?lng=en
3.scan your system for rootkitshttp://www.usec.at/rootkit.html
4.scan with mbamhttp://www.malwarebytes.org/mbam.php
5.post a Hijack Hunter log in this topichttp://www.novirusthanks.org/products/hijack-hunter/
6.we will provide a cleaning script,you should run it with Threat Killer

3
Avast can't seem to move it to the chest or delete it.
have you tried avast boot scan?

http://sites.google.com/site/spg20scottsweb/home/avast-5-boot-time-scan

4

What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?

5
What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx)

+1.
This should be the first step to take.
Further treatment without proper investigation of the detection may be a waste of time, and some of the treatment suggested could do harm where it isn’t necessary.

6

well according to avast there are 8 infected files all in C:/programmedata/installations.

i have started trying what superhacker suggested.ran dr web cureit. it found nothing just like every other antivirius i’ve run other then avast. starting running the antirootkit thing and the computer crashes just before completion

What the hell is wrong with my computer? or is the problem with avast?

7

Can you post the original names of each of the detections within that folder, please?
What operating system is it? (And the language of the OS)

8

im using windows vista

C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\Nokia PC Suite\Nokia PC Suite.msi\Data1.cab\phonebrowser.dll
C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\Nokia PC Suite\Nokia PC Suite.msi\Data1.cab\phonebrowser.dll1
C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\PCCS\PCCS.msi\Data1.cab\dbaccess.dll

C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\PCCS\PCCS.msi\Data1.cab\nox.dll

C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\PCCS\PCCS.msi\Data1.cab\nclds.dll

C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\PCCS\PCCS.msi\Data1.cab\ncllcif.dll

C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\PCCS\PCCS.msi\Data1.cab\nclpimaccess.dll

C:\ProgramData\Installations{57A48477-92F0-4C1F-ADF9-4806C4EC3CF2}\Installations\PCCS\PCCS.msi\Data1.cab\secureplatformtoolkit.dll

sorry im not extremly knowlegable bout this stuff.i hope this is what u wanted

9

maybe this info is usefull…
http://forum.avast.com/index.php?topic=62812.0
http://forum.avast.com/index.php?topic=55466.0

10

Looking at that, and the topics Pondus linked to, it sure looks like a false positive.
You might like to upload each of those files to virustotal (see reply# 1 on the first of Pondus’ links) to indicate for your own peace of mind that nothing else detects them (G-data, another AV, is likely to be the only one that will - Avast and Gdata share an engine).

Then they should be submitted to Avast as false detections, if you need your Nokia suite to function without being blocked the files/folder can be excluded from scanning until a fix is achieved.

Whether that fix is from Avast or an update from Nokia, I couldn’t say, but I’d suspect Avast, since it’s the only one to detect this, as far as we know so far.

11

Thanks.

I’ve actually uninstalled the nokia pc suite since i dont use it anymore and it seems to have solved the problem

thanks everyone for your help

12

You are welcome :wink: