About this Win32:Trojan-gen. {Other}

[bizunlim]

Basically, the latest VPS update should resolve all known false positives...

Hello,

I really appreciate Avast AV, but when I tried to install a new software from what appears to be a very reputable site, Avast said I had this particular trojan gen AND this one, as well, in the installation of it:
Win32:SdBot-825[trj]

And I am wondering if it is a 'false positive' or a real danger?  If so, I will have to report it to them immediately.  I want the software (and more from their site, which I seriously doubt is faulty or full of viruses) but I'm scared to execute the program now...  

Can you help me?  I have the latest updates of the home version in both the software and the virus database according to my Avast software.

Thank you sooooo much,
Donna

[bob3160]

BizUnlim
Welcome to the Forums
Please help us help you.
What version of Avast! are you using
What vps version?
What OS?
Where exactly is the file located
Whats the name of the Download Site?
etc. etc.

[borolo]

Hi, I'm getting this virus also.

I'm using w98
avast 4.1 home edition
file version 0434-1

When I open the MS explorer or MSN messenger a pop up window appears and immediately the virus warning appears.
It says it's allocated in c:\windows\submit2.exe
I tell it to delete it and it reapears in c:\windows\sdkqh32.dll

I used also the avast virus cleaner with no luck.

Also used CWShredder v1.59.1 and detects: CWS affiliate:Winshow. It cleans it but it is reapearing again.

What should i do??

thanks

[tokenjo]

SOLUTION FOUND!


AFTER SCANNING, DELETE THEN RESTART

[Eddy]

SOLUTION FOUND!

Not likely. There are likey more things that need to be done. Click on the link in my signature and follow all steps on that page to make sure your system is clean.

[borolo]

Thanks Eddie, I have some of these prgrams running. I'll try them in safemode to see what happens.

I'll let you know.

[PaulVDV]

Hello,

I got the same virus warning on the file c:\windows\system32\video_s32d.exe.
AVG cannot repair the file.

My AVG version is 4.1 Home Edition
Build Jun 2004 (4.1.418)
VPS 0434-2

Is this a false alarm ?

Thanks,
-Paul

[Eddy]

Run one or two online scanners and see if they pick that file up. Since google has nothing on it, it sure is a suspicious file.

[bob3160]

PaulVDV
Welcome to the Forum.

My AVG version is 4.1 Home Edition

I didn't know they made that version!
I think you meant Avast! version is 4.1 Home Edition didn't you?

[PaulVDV]

Well, yes of course, it was Avast and not AVG ! Sorry for the confusion.

When I try online scanner, I get the following :

- with Computer associates: Win32.Rbot.IF
- with Kaspersky : Backdoor.Rbot.gen
- with Avast : Win32:Trojan-gen. {Other}

Which one is the right one ? None of them can clean it. What should I do ?

PS. Avast signature is now 0435 but still reports the problem.
I will submit the file to  virus@avast.com.

Thanks,
-Paul

[whocares]

I will submit the file to  virus@avast.com.

Hi Paul,
no need to report the file, if it's a confirmed detection, is there..?

here's some info&removal instructions for it:
VGREP
the red links to Trendmicro, Symantec and mcafee are usually the most helpful..

or just try deleting the file in SafeMode
and APPLY all windowsupdates, and change all your passwords..

plus follow instructions in eddy's signature, or "VirusRemoval" below..

and post a hijackthis-Log