Author Topic: please help!!!  (Read 4722 times)

0 Members and 1 Guest are viewing this topic.

Offline batterio

  • Newbie
  • *
  • Posts: 16
please help!!!
« on: March 24, 2006, 09:03:06 PM »
hi .this is my first time here, can anyone help me?
i am running avast 4.6 up to date home edition
windows xp s2p
during a scan launched by me today it found this win32:Agent-KW Trojan twice, situated in a p2p program(pplive), which i installed sometime ago, but never was a malware found so far (i run a scan weekly). well one was blocked from the web. anyway, i moved this two files to the chest as suggested. the two infected files are one in the set up.exe and the other is in the uninstall.exe. of the p2p software. i wouldn't mind to cancel the infected files and to get rid of the software altogether, but if i delete the uninstall.exe file, will i still be able to uninstall and delete the software? moreover is it safe to use p2p softwares? i see that avast checks some of them but this one wasn't. thanks, i wait for a gentle soul to help me out.
uninst.exe  C:\Program Files\Common Files\Synacast
SynaLiveSetup.exe  C:\Program Files\PPLiveTV
now i have just scanned the software again and it is clean. does it mean the trojans are in the chest? please, anyone can help?
« Last Edit: March 25, 2006, 01:46:48 AM by batterio »

Offline CharleyO

  • Avast Evangelist
  • Starting Graphoman
  • ***
  • Posts: 7087
  • Be alert for error code - ID 10T
Re: please help!!!
« Reply #1 on: March 25, 2006, 07:30:46 AM »
***

Welcome to the forums, batterio.    :)

You can open the Chest and take a look to see if they are there. If they are, leave them there and they can do no harm. After about 2 weeks, if your computer and/or applications are running fine, you can re-scan the files in the Chest (right click a file & choose scan) and if still infected delete them perminately.

To Open the Chest, right click the "a" ball and choose "Start avast! antivirus..." Once the user interface opens, mouse over the icons until you find the "Virus Chest." Click the icon once to open the chest. On the left side is the Categories list. Click on "Infected Files" if it is not already selected as the main window. This is where you should find the files you have sent to the Chest.

What ever else you do, do not delete the listings under "System files" as these are backup files.

I hope this helps you.    :)


***
Self-built desktop (8 years old) - AMD64 3200+_Gigabyte GA-K8NS Ultra-939_4 gb RAM_GeForceFX 5800w/256 ram_XP/SP3_Avast 7_MBAM_ZA Free __and__ Toshiba Satellite Laptop_W7-64bit_ 4 gb Ram_Avast 8_MBAM

Offline batterio

  • Newbie
  • *
  • Posts: 16
Re: please help!!!
« Reply #2 on: March 25, 2006, 05:53:11 PM »
thanks very much. i will leave them there. i don' t know though if i can still use the program in the meantime and if i can uninstall/delete the program and download it anew. thanks

Offline Spiritsongs

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1758
  • Ad-aware orientated Support forum(s)
P2P programs
« Reply #3 on: March 25, 2006, 08:12:56 PM »
 :)  Hi Batterio :

     It is NOT safe to use P2P programs, especially when there
     are "cleaner" alternatives like Shareaza available from
     www.shareaza.com .
For the Best in what counts in Life :
www.tacf.org

Offline mercurio

  • Newbie
  • *
  • Posts: 11
  • I'm a llama!
Re: please help!!!
« Reply #4 on: March 26, 2006, 12:53:35 AM »
hi, I have the same problem!!! I want to say that pplive isn't a p2p program, but a p2p-tv one!!!! It is used to see television on internet and it's based on a p2p system. When I try to install it, avast blocks the installation because it finds a trojan.When I do the quick scan instead, it doesn't find nothing.

Offline polonus

  • Avast Überevangelist
  • Maybe Bot
  • *****
  • Posts: 31449
  • malware fighter
Re: please help!!!
« Reply #5 on: March 26, 2006, 01:00:52 AM »
Hi Mercurio,

Did you try to update the file in question to jotti or virustotal to have it analyzed. What are the results there?
What is the information on fileadvisor? Does it have info on it?

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline mercurio

  • Newbie
  • *
  • Posts: 11
  • I'm a llama!
Re: please help!!!
« Reply #6 on: March 26, 2006, 10:51:14 AM »
well, the setup file of pplive is an archive.when I double click on it to install, avast blocks all and it saiys to me that it has found a trojan in the file named "synacastsetup.exe".this file is extracted from the archive automatically,so I can't take it and send to analize on line.can i take it from avast chest???????

Offline Flyboy9

  • Newbie
  • *
  • Posts: 1
Re: please help!!!
« Reply #7 on: March 28, 2006, 10:38:39 AM »
I have exactly the same problem.  its only been recognised recently. 
I have scanned the file with ewido anti-malware and its come up clean.  I also scanned with the online scanner which also came up clean?

is this a true virus or just a false positive?

thanks

Offline batterio

  • Newbie
  • *
  • Posts: 16
Re: please help!!!
« Reply #8 on: March 29, 2006, 09:08:02 PM »
 :P hi, everything should be ok. i inquired with some tv-streaming sites and it is only recently that avast and only another couple of av find this trj. it is said it is only a file that helps the software to increase the download of data. one can either sideline them to the chest or delete them altogether; the program will work still ok. to install it, you must uninstall avast and then afterwards you can run it again. the first scan you will find it so you can delete it. i hope this can help. ciao