12 replies to this topic

[Un1man]

Hi, Ad-Aware detects two processes: smss.exe and svchost.exe as Trojan.Win32.Generic!BT . I've tried quarantining and deleting these files, but they still appear after reboot. Sound has disappeared on my computer and I get a login window to sign in as a user on my computer even when I never created any alternative users. So I think I really have a trojan virus. Any help in deleting it is appreciated!

Attached Files

•  Ad_Aware_scan_log.txt   39.03K   3 downloads

[LS Albin (former Lavasoft employee)]

Hi, Ad-Aware detects two processes: smss.exe and svchost.exe as Trojan.Win32.Generic!BT . I've tried quarantining and deleting these files, but they still appear after reboot. Sound has disappeared on my computer and I get a login window to sign in as a user on my computer even when I never created any alternative users. So I think I really have a trojan virus. Any help in deleting it is appreciated!

Hi!

This is a forum dedicated to false positive issues. Please use this link for more help:

http://www.lavasofts...hp?showforum=61

Thanks

Albin

Lavasoft Malware Labs

[Un1man]

Hi!

This is a forum dedicated to false positive issues. Please use this link for more help:

http://www.lavasofts...hp?showforum=61

Thanks

Albin

Lavasoft Malware Labs

Well, if it's a false positive I don't need to delete anything, right? What I mean is that this seems to be the right forum for my issue.

[LS Albin (former Lavasoft employee)]

Hi!

You can submit the detected files in this thread. It would be helpful so we could look further into this issue.

Here is instructions how to post a FP:

http://www.lavasofts...showtopic=18033

Thanks

Albin

Lavasoft Malware Labs

[Un1man]

Hi,

Since I don't have access to the suspected files, I copied their paths from the quarantine. I hope that's helpful.

Attached Files

•  Filepaths.txt   127bytes   4 downloads

[LS Albin (former Lavasoft employee)]

Hi,

Since I don't have access to the suspected files, I copied their paths from the quarantine. I hope that's helpful.

Hi!

It would be nice if it was possible to get hold of the actual files.

I don't believe this is fp's, smss.exe and svchost.exe should not be located in: c:\system volume information\_restore{d5fffa500b1b}. I can't tell you for sure until we get hold of the files.

Thanks

Albin

Lavasoft Malware Labs

[visitor]

Since I don't have access to the suspected files, I copied their paths from the quarantine.

Why not restore the files from quarantine? At least temporarily, so you can upload them. Then you can scan/quarantine them again until you find out if they're safe or not.

[Un1man]

Thanks for your help guys, I'm not too experienced with this, had some trouble zipping the files. Here they are.

Attached Files

•  smss.zip   27.07K   1 downloads
•  svchost.zip   20.62K   1 downloads

[LS Albin (former Lavasoft employee)]

Hi !

Smss.exe is a malicious file. I couldn't extract the archive for svchost.exe. I guess you typed some wrong letter in the password. The password should be infected. My assumption is that svhost.exe is a malicious file aswell.

Thanks for your report

Albin

Lavasoft Malware Labs

[Un1man]

Hello,
Thanks for letting me know of that, but do you know how to get rid of these files? I've tried SuperAntiSpyware, MalwareBytes, and Ad-Aware, none of them can delete these files...

[LS Anders]

Hello

Try posting your problem in this forum:
http://www.lavasofts...hp?showforum=61

Regards
LS Anders

[Un1man]

Hi Anders,

I have posted it there already but the topic was locked by another Lavasoft staff. It's here: http://www.lavasofts...showtopic=29637 .

[visitor]

Hi Anders,

I have posted it there already but the topic was locked by another Lavasoft staff. It's here: http://www.lavasofts...showtopic=29637 .

That was before you uploaded the files to confirm they're malicious. Now that it's confirmed, you should follow the instructions in my signature for posting in the HijackThis forum. After following the steps, someone can help you diagnose and remove malware.

Edit: now that user has posted in HJT, I'll close this thread. Moved/merged the GMER log posted here to there:

http://www.lavasofts...showtopic=29686

Edited by visitor, 21 July 2010 - 02:35 PM.