trojan problem

[painterh]

Hello, I am new to this forum, but have been using Avast Home user for quite a while now without incident.  Recently a program I have had installed for some time started exhibiting the following behavior.  When I try to open the program it immediately sets off the virus alarm saying it found a trojan.  The name of the file is C:\windows\system32\pqdvd.dll.  The name of the malware is identified as Win32:Pcclient-CO[trj].   I can only assume that it was in the program all along and that some recent update to Avast identified it.  If anyone has any idea idea how to work around this it would be very helpful.  The program is PQDVD Studio.  It is for converting DVDs to palm format for use on my pda. Thanks in advance.
 
 
 

[DavidR]

The Win32:Pcclient-CO[trj] detection was only added in the VPS update for 21/8/2006 see http://www.avast.com/eng/vps_history.html.

To confirm a correct detection, you could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can't do this with the file in the chest, you will need to move it out.

Let us know the outcome.

[Atsee]

Hello, I'm also new and I have had no problems with Avast till yesterday. It says it found a trojan horse in the file C:\windows\system32\pqdvd.dll.  The name is Win32:Pcclient-CO[trj].
Like painterh. And guess what. The program is PQ DVD Studio 4.0.
They (PQ, the makers) say that the file is clean and that it is a false alarm.

The email:
If you're using Avast Anti-virus program, it'll report this false alarms.

You need to contact your Anti-Virus program vendor and ask them to check our download, see if they actually can detect any Trojan Horse on the download link.

PQDVD Support Team

Can you help me (us)?
Thanks.

[DavidR]

Same as my above post if it confirma no other AV scanner is detecting this then it can reasonably be assumed it is a false posiotive detection.

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced and Program Settings, Exclusions) and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.

If you are getting a virus warning that you believe is a then if you can zip and password protect ('virus', will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

[igor]

I downloaded DVD Studio 4, but didn't find any pqdvd.dll file inside of the installer. Can you please submit the file, as DavidR described?

[painterh]

I have about a dozen copies of the file in my virus chest, but when I try to submit by email to avast, windows tells me that it was blocking the sending of potentialy dangerous file.  I am not sure how to zip this file in order to send it.

[Lisandro]

windows tells me.

Windows or avast? Did you disable the smtp scanning of avast?
You can extract the file to a folder in your computer, zip it and send it by email (attached).

[Atsee]

Today a new VPS filefrom AVAST arrived and was automatically installed.
(Compilation date 23-8-2006, File version 0634-1)
and guess what....??
No more problems. Everything works as before.
Thanks Avast!

javascript:replaceText(' ', document.postmodify.message);
Huh

[DavidR]

Ok glad that it is resolved but for the future, check out the information and image below.

I have about a dozen copies of the file in my virus chest, but when I try to submit by email to avast, windows tells me that it was blocking the sending of potentialy dangerous file.  I am not sure how to zip this file in order to send it.

I assume that your are using outlook express and are falling foul of a windows attachment restriction it thinks .tmp files are dangerous, pathetic really. See image to disable restriction.

[painterh]

I too now have everything working again.  It was MSN Explorer on my end that wouldn't let me send file.  I zipped it and sent it.  Hope they get it sorted out.  Must have been a false positive because Trend Net's online scanner found nothing in my system.  Thanks for the help.

[DavidR]

Yes, MSN is another one that uses this windows attachment restriction, probably hotmail too.

For the future, it is better to use multi engine scanners to confirm a potential fasle positive, virustotal has 27 so you will have a higer degree of certainty after that.

A belated welcome to the forums.