Win32:Dropper-AZU [Trj] HELP! can't moveto vault can't delete

[igster23]

hi there,

 i picked u the following trojan horse: Win32:Dropper-AZU [trj]   However I can't seem to move it  to chest, delete  it or do anything.

can someone tell me how to get rid of this and move on please?

THnaks iggy

[DavidR]

Why can't it be moved to the chest, what errors are displayed, file in use, etc.) ?

If you have XP, vista32bit or Win2k, you could enable a boot time scan. Right click the avast icon, select Start avast! Antivirus, a memory scan will take place followed by the opening of the Simple User Interface, Menu, 'Schedule boot-time scan...' Or see http://www.digitalred.com/avast-boot-time.php.

[igster23]

Hi David,

Tnaks for your reply.  the message comes up saying 'the file is a decompression bomb'  and that it cannot process  it is saved in my download file from from a p2p site.

Please advise what to do next?  Will deleteing it stop the problem?

[DavidR]

There is nothing to worry about and deletion isn't advised.

What is the file name, what is its purpose (program/game, etc.) ?

Decompression Bomb, a file that is highly compressed, which could be very large when decompressed. This used to be a tactic long ago to swamp the system, see http://forum.avast.com/index.php?topic=8943.msg73950#msg73950

[igster23]

Hi thanks very much for your help so far;

the file name is: sony cinescore v1.0c incl keygen-SSG.rar\file.exe

sony cinescore is a music generating systme and i was downloading a copy with a keygen from mininova  atorrent download site.

Can you please suggest what to do next at the moment I am using my laptop with the avas warning pop up.

thanks again

[DavidR]

Yes a .rar file could be highly compressed so accounts for the decompression bomb issue.

However what is more to the point is the virus alert, which considering the name (with keygen in it) I would have to question if this is a legit file since a) it is from a P2P source and b) I don't believe Sony distribute their software in this way .

P2P downloads are from totally unknown sources and are high risk, this is especially true if that is for cracked/hacked/keygen associated software. Apart from any moral/legal issues you are highly likely to get some unwelcome guests along with the cracked software.

So personally I would say you should get rid of it.

[igster23]

Hi Don't worry I will be getting rid of it!

But what do I do to get this trojan horse of my computer?  Sorry for asking but I am a complete novice at tackling these isses.

Do i:

1; Close the warning down
2. run boot time scan?

Will this be ok if I just never use the file?

please could you give a step by step of what to do

thanks

[DavidR]

It is only present within the sony cinescore v1.0c incl keygen-SSG.rar file so getting rid (delete) of that file will get rid of the file within it that was being detected.

You can't just not use that file, it will be an integral part, if you chose to unpack that .rar file and install the program then the trojan too would be installed, that is the whole concept of the trojan infection, it comes with something else that you think you are installing only to find it has guests along for the party.

[igster23]

Hi I tried asking Avast to delete the file and the same message came up about a decompression bomb.

How do I get rid of this?

Thanks

[DavidR]

Delete the file manually using windows explorer, navigate to where it is on your HDD and delete it...

avast would be trying to delete the file with in the .rar file and because of a) it being a .rar archive it could corrupt it in trying to put it back together and b) it would probably have to extract all the data first, hence the decompression alert again.