Kernel32.dll Avast scan problem and Virus warning

[DavidR]

As I said it is impossible to quarantine a memory detection as it isn't a physical file. The named file/process isn't what is being detected but what was responsible for loading whatever is detected in that memory block.

The support package would normally be used when there was a crash or problem with avast, etc. and would normally be asked for rather than sent and not in relation to something like this as the information it is gathering wouldn't relate to detections (it is more debug data for the developers).

[KillerX]

@DavidR

Ohman, iam saying that i havent quarantined the Trojans avast memory scan found, but 2 Trojan.Agent/ Gen- Downloader and 1 Trojan.Agent/ Gen- Koobface with SUPERantispyware.

But the Trojans which showed up at the avast memory scan havent showed up today, only yesterday and every security program (Avast, SUPERAntiSpyware etc.) says my computer is clean.

The programs it said to have loaded the trojan were like: Asus AI suite 2, Razer Driver programs and Creative audio programs etc. theres to many to tell but none that have been infected when downloaded and installed. But the programs that it detected to have loaded the file into my system doesn't show up on todays memory virus scan or even shown as a virus in the Harddrive scan.

Can a trojan infect the windows Kernel32.dll file? because that is the file that showed up inside () after i checked the scan log file after the scan crashed my computer.

Ok so im not gonna send a support package? Thanks for the help.

[DavidR]

I'm sorry I simply can't answer your questions with out supporting information, if you were ab;le to send them to the chest (then they weren't memory detections) and the information on the detection would be in the chest, file name, original location and malware name.

I don't know what you mean by showed up between the () if it relates to the memory detection, you still haven't grasped the way detections in memory are reported, it always lists the process responsible for loading that memory block, it isn't an indication that that file is infected. If it were infected then the file system shield would alert on it.

[KillerX]

Hers a screenshot of the problem, hope imagehack is ok for posting pictures i didnt find how to attach a picture in the forum, but this is the scan result.
All of these which are shown in the scan log dosent show up anymore no matter how many times i do a memory scan.

http://imageshack.us/photo/my-images/195/avastkernel32dllviruswa.jpg/

Thanks for the help.

EDIT: Forgot to mention that everything is in Swedish so you know , cuz im from Sweden.

[DavidR]

In the reply window, there is a cunningly disguised 'Attachments and other options' click that and it expands to allow image and certain file attachments.

Unfortunately many people can't view imageshack.us as they block many domains/locations and you also can't expand the image, so it can't be view at full size.

Though the text is just about readable. The problem being I have never seen the memory block detections laid out in this way as the responsible process is at the start in [square brackets], then the memory block, but I haven't seen reference to (kernel32.dll) at the end.

[KillerX]

@DavidR

Sorry i didnt know it was under attachments and other options. Here i attach the picture again.
But i think the text is to small to be readable .

So you really dont know what the cause of this virus is? Cuz i have no idea, cuz its all clean right now i havent found anything with the memory scan today.

[DavidR]

I was able to read enough even on imageshack.us, and my comments in my post reflected that, I have never seen an instance in the use of (brackets) at the end where it doesn't relate directly to the process that loaded the data into memory block

[KillerX]

@DavidR

Ok thanks for the help. i think its easiest to assume now that the system is safe because none of my security programs have found anything wrong, neither in the memory or harddrive.
Strange thou that you havent seen the instance of the brackets at the end to show the file, because it has been like that in ver. 5 and 6 too i can try switching language to see if that changes anything .

Ohwell Thanks for all the help either way As long as it doesn't show up again i assume my system is safe then.

[DavidR]

You're welcome.

I couldn't even replicate it by creating my own custom scan including memory.