LaCie little disk and win32:trojan-gen (other)

[marie-therese]

1) disable system restore??? how do i do that?

2) yes, USB drive, LaCie Little Disk. this is how the story began, and the problem is still there. I had to make the backup manually.

3) yes, i did run avast at boot time, the result is somewhere above.

4) ok, thanks.

[marie-therese]

I found how to disable the restore system, but I can't do it, please explain (sorry it is clear for you, make it for dummies... )

[Lisandro]

1) disable system restore??? how do i do that?

Click on the links over your operational system in the post I've done before.

2) yes, USB drive, LaCie Little Disk. this is how the story began, and the problem is still there. I had to make the backup manually.

• Download Flash Drive Disinfector and save it to your desktop.
  
• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.
• Note: Flash Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder... it will help protect your drives from future infection.

[marie-therese]

flash desinfector: as I said to the other person, I did it, and i was told by Spyware doctor that it had virus...
It run anyway, and said "done" without anything more after a couple of seconds.

[Lisandro]

flash desinfector: as I said to the other person, I did it, and i was told by Spyware doctor that it had virus...
It run anyway, and said "done" without anything more after a couple of seconds.

So, right now the only infected activity is in your USB drive and it's done by an .exe file?

[marie-therese]

Sorry I did not answer immediately but I was restoring and it took some time and gave me some fear, because the screen stayed black very long...
I took the oldest point I could find, (7/10), i was the first time I was doing that and had the surprise to see disappear every software download and even the avast back in French (woman speaking instead of English man, lololol)

1) Concerning the problem, if all what we did clean my computer and hopefully improve the system (by the way HP also just sent some improvement for Windows Vista...)

The exe file is the file that permits an automatic backup from the files to the backup drive. I still can make a copy of the files manually, but of course it is easier to do the automatic backup, it scan the files and see which ones were moved or were deleted or were added and give a log.

2) which antivirus (avast of course) and antispyware should I keep?

[Lisandro]

The exe file is the file that permits an automatic backup from the files to the backup drive.

Which is its name, I mean, the file name? Which is the name of the program that makes backup? Did you send this file (.exe) to www.virustotal.com to test it?

2) which antivirus (avast of course) and antispyware should I keep?

Keep avast and, at least, superantispyware. But you could keep the others (MBAM and ST too for on-demand scannings).

[marie-therese]

yes, I did virustotal, it was in a message at the beginning of the thread.

Now I have another problem the blue avast has a red sign saying (sorry in French):
Le sous-système AAVM a detecté une erreur RPC...

here the virus total... take the time to read the whole thread, I did everything already !!!! two days that i am running stuff for this problem!!!! 

Fichier LaCieSync_v7_1_028.exe reçu le 2008.10.06 12:23:50 (CET)
Situation actuelle: terminé
Résultat: 3/36 (8.33%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus    Version    Dernière mise à jour    Résultat
AhnLab-V3    2008.10.3.2    2008.10.06    -
AntiVir    7.8.1.34    2008.10.06    -
Authentium    5.1.0.4    2008.10.05    -
Avast    4.8.1248.0    2008.10.05    -
AVG    8.0.0.161    2008.10.05    -
BitDefender    7.2    2008.10.06    -
CAT-QuickHeal    9.50    2008.10.06    -
ClamAV    0.93.1    2008.10.06    -
DrWeb    4.44.0.09170    2008.10.06    -
eSafe    7.0.17.0    2008.10.05    Suspicious File
eTrust-Vet    31.6.6131    2008.10.06    -
Ewido    4.0    2008.10.05    -
F-Prot    4.4.4.56    2008.10.05    -
F-Secure    8.0.14332.0    2008.10.06    -
Fortinet    3.113.0.0    2008.10.06    -
GData    19    2008.10.06    -
Ikarus    T3.1.1.34.0    2008.10.06    -
K7AntiVirus    7.10.484    2008.10.04    -
Kaspersky    7.0.0.125    2008.10.06    -
McAfee    5398    2008.10.04    -
Microsoft    1.4005    2008.10.06    -
NOD32    3496    2008.10.06    -
Norman    5.80.02    2008.10.03    -
Panda    9.0.0.4    2008.10.05    -
PCTools    4.4.2.0    2008.10.05    -
Prevx1    V2    2008.10.06    Suspicious
Rising    20.65.02.00    2008.10.06    -
SecureWeb-Gateway    6.7.6    2008.10.06    Win32.Malware.gen#PEBundle (suspicious)
Sophos    4.34.0    2008.10.06    -
Sunbelt    3.1.1704.1    2008.10.05    -
Symantec    10    2008.10.06    -
TheHacker    6.3.1.0.101    2008.10.04    -
TrendMicro    8.700.0.1004    2008.10.06    -
VBA32    3.12.8.6    2008.10.05    -
ViRobot    2008.10.6.1408    2008.10.06    -
VirusBuster    4.5.11.0    2008.10.05    -

[Lisandro]

marie-therese, the only thing is wait to Alwil to correct the false postive then...
The file seems to be clean.

[marie-therese]

oh god!!!

I saw all the FAQ about the little red on the blue avast button and i did it... i'll go to sleep now, and will see tomorrow if it works. If not, I will open another thread tomorrow

Thank you very much,

Muito obrigada, viva Brazil!

[marie-therese]

Finally I wrote to LaCie the company of the hard disk backup drive, asking for a new version of the life infected (false positive or not, we still don't know).
the first answer was that they did not use this software any more and did not have a new copy to send. After insisting that it was a new hard drive just bought, they gave me a link for the new software they now use.
So my problem is basically solved. I think. I hope.

Of course, now I use all the software you guys recommended me.

Thanks.