Trojan-gen{other}

[BlueSteel]

I have a problem with  a persistent virus,
I am running Avast 4 Pro. the OS is windows XP pro.
After Starting Avast on my computer and while Avast is going through the memory test it gives me the message, A Virus Was Found.
Win32:Trojan-gen. {Other}
c:\windows\system32:mixhbkk.dll
When I attempted to delete it I got the message:
The process cannot access the file because it is being used by another process! :
I attempted to search for the stated file on my hard disk but could not find it anywhere!!!
I also checked the running processes in task manager but I could not find anything out of the ordinary.

I heard this is one of the best forums out there, could anyone out there with some knowledge of how to get rid of this virus PLEASE post your advice, much appreciated.

Cheers
AD

[CoJo]

AD, welcome to the forums...someone with more computer experience than I will soon be along to help you.
In the meantime, have you tried to do a search on it? There have been many posts on how to do this...perhaps while you wait for an expert, you could do the search?

cojo

[JEfromCanada]

After Starting Avast on my computer and while Avast is going through the memory test it gives me the message, A Virus Was Found.
Win32:Trojan-gen. {Other}
c:\windows\system32:mixhbkk.dll

What version of the program and database (VPS) file are you using?  Do you have the program set to auto-update the VPS files?  The next-to-current version of the VPS file had reported several "false positives".

If you are unsure whether you are using the most up-to-date version of avast, try doing an update and see if it still reports the file in question as being infected.  If it does, follow the steps below:

Step 1 is to attempt to verify an infection by using one of the online virus scanners.  I used Trend Micro the other day.  There are others.

Step 2, if the online scanner indicates there is NO PROBLEM with your system, then stop the AVG program from running, find the reported DLL file, and zip it up (password protect the zip file so it won't be flagged as virus infected when you try to email it).  Email the zipped file (along with the password) to virus@avast.com so these guys can take a look at the file.  When you email the file, tell them exactly what directory the file was located in.

[Max M.Wachtel III]

I had a simular problem the past two days.On my XP + ME computers the trojan was in "common files".On the ME,I scanned 3 times and it kept comming back.Reboot into safe-mode(after disabling system restore) and I used Eraser 5.3 to delete the files the trojan was in.So far so good.I have just started using XP.Does XP have something like "safe-mode?
By the way-is there a guide for all settimgs in avast?
I am trying to lock down my computer and not have all those messages pop up whenever I do anything.I don't mind it but on my wife's it is a bit much for her.

[mauropanichella]

I´ve got the same problem with the file in win/sys32/preload.ocx when i try to repair it (with vrdb) no message appears, so i assume that the file has been repaired, but the next time the file is detected again.
I´m using XP with the latest VPS

[Lisandro]

Does XP have something like "safe-mode?

You have to install the 'Restoring Console' (poor translation) as boot option in XP. Look (search) in the help for 'console' and you will find the exact command for it. It's not like the safe mode but it's the best of XP has.
Other option is pressing down the F8 key while booting and you will see a lot of booting options... Please, don't do anything if you are not sure... Changing the XP boot could let you in 'hot water'  

By the way-is there a guide for all settimgs in avast?

Here you have a lot of avast! 'hidden' configurations: http://www.avast.com/forum/index.php?board=2;action=display;threadid=1647

I am trying to lock down my computer and not have all those messages pop up whenever I do anything.I don't mind it but on my wife's it is a bit much for her.

Disable the setting 'Show detailed information...' (I'm trying to translate the meaning of the option...) at the Advanced tab of the providers settings. It's uncheck by default but maybe you have check it sometime ago...


Hope this help.