Trojan/Avast

Repa, Have you had this problem with Avast?

Yesterday, when I was trying to update all my security anti-virus programs, Avast opened a window, saying I had a Trojan Horse. At the time, A-Squared was updating, and here's what the Avast window said.

File Name: C:\ProgramFiles\A-SquaredFree\a2framework.dll

Malware Name: Win32Delf-MZG[Trj] Type: Trojan Horse

VPS Version: 091203-0

It said to Try to follow given advice and links.
The Recommended Action was to Move To Chest
Note: If you press the "No Action" button, the malware will not be activated.

First, I clicked "Move To Chest", nothing happened. So, I tried clicking the "No Action" button. Nothing again, or so I thought, because the trojan warning from Avast kept popping up.

Anyway, next, I was trying to update Spybot, and the Avast warning came up again. The window was all the same, except this time under File Name: C:\ProgramFiles\Spybot-SearchandDestroy\Spybot I'm not sure if this time it also had a2framework.dll; I don't think it did because I didn't write it down. Again, I clicked Move To Chest, then, the "No Action" button.

So, now, ever since, I couldn't even open up Spybot. When I tried to open Spybot, it said: "Windows cannot access the specified device, path,or file. Then, an Avast said a Virus Data Base has been installed. After that, I could, & can, open up Spybot, but, when I click "Search For Updates, it will not find updates. I did the same things with A-Squared, move to chest, etc, but, it still updates, but Spybot won't.

At first, I was afraid to go online, but, I figured if I've got a trojan anyway, i still should be able to go online, and post this. I also searched the Malware Name: Win32Delf-MZG[Trj] at google. I think this is a false positive.

Do you know what happened to Spybot, that it will not update? I hope you don't tell me that I will have to uninstall it, and then re-install?

This thing has got me going, Please help.

The problem you are having with Spybot and Avast is a false positive and the fix is discussed here:

http://forums.spybot.info/showthread.php?p=349960

You might try restoring your system to a time before this happened to see if you can avoid uninstalling and re-installing Spybot. Update Avast immediately (both Virus and Program updates) after the restore and then see if Spybot will run and update properly. If not, then see if the Avast Virus Chest has any of the Spybot programs and restore them from the chest and see if Spybot will now run and update properly. Here's step-by-step how to restore from the Avast virus chest if you don't know how to do it:

http://support.avast.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=376

If that doesn't work, then follow the instructions given in the first link above for uninstalling/reinstalling Spybot.

Repa,

I got that error from AVAST. I figured it was a false positive but did not have time to mess with it right then so just moved it to the virus chest. My avast has been updated- so I restored the file form the virus chest and all seems ok.

Thanks,
Fay

wcturner wrote:

Hey, Repa,
The system restore worked. I don't know why I can never think to try system restore when there's a problem. Got Avast updated. Spybot updated and it ran normally. Therefore, I don't have to look at Avast virus chest for spybot, or do anything else, Correct?

Correct. Wish everyone would remember to try a system restore first to a time before when things go wrong or something suddenly stops working correctly. It works most of the time.

One more question. My McAfee Site Advisor icon at the bottom, above the task tray, is a washed out gray color, instead of the usual green. I assume that means it's off. Do you know how to turn it on?

Don't know as I don't use it that way - it's not on my computer. When I want to find out about a website from Site Advisor, I go here:

http://www.siteadvisor.com/sites/partition-tool.com

and type the website address into the text box beside "View a Site Report" near the top righthand side of the web page and then click on the red > to the right of the text box.

You may want to uninstall and re-install Site Advisor if you can't figure it out.

Here's something to take note of about SiteAdvisor:

http://www.siteadvisor.com/sites/siteadvisor.com/msgpage?page=3#reviews

I did a site report on SiteAdvisor itself (see above link) and you should take note of the user reviews. When you use SiteAdvisor, read the user reviews and you will sometimes find very negative user reviews on a site that SiteAdvisor calls Green. One reviewer at the link above gave some insight as to why this is true. Here's a quote of his post:

Quote :

this site can be misleading to users. its apparent that mcafee engages in some types of bribe taking and biasm when rating sites, now oftentimes very dangerous sites are rated only yellow or even green, its clear to see that this is caused by the site trying to pull the cover up for its partners, its very helpful only in the context that users are able to comment as i go by what people say rather than mcafees ratings, its a helpful site but mcafee can be oftentimes counterproductvie in helping users, rating a site green means its safe to use and some people can be mislead by dangerous sites that are green, all in all if users dont visit the site and read other users posts sometimes they will fall right into the hands of a dangerous site, as if siteadvisor wasnt here, thanks a lot mcafee


Posted at 11/11/2009-12:09:01 PM by mjfromga, Reviewer , View profile [ Reputation score: 8 / 9 ]

So, all I can say is, beware when you use SiteAdvisor, and read the user reviews before trusting the rating.

wc,

I had the exact same problem with the trojan horses with Avast. Glad to hear that it wasn't just me!

I just now re-installed site advisor. Now, on our desktop computer, instead of the green at the bottom, it's near the top, under the toolbar. I had the same problem with it being gray, so I clicked on the down arrow next to it, and one of the choices was "enable site advisor" or something similar. I clicked that and now the green is back. Almost the full bar is green and near the end it has a slash and the last bit is still gray, but according to their site, that's how it's supposed to be.

Thanks for the info Repa!

Ruth

Correction---

When I wrote the post above, I was on IE, but I went on Firefox later, site advisor was still at the bottom. I had forgot that was on IE before.

I apologize for any confusion!