Trojan horse Generic 10 - what to do?

[silkie]

Within the last couple of days both AVG AntiSpyware and AVG AntiVirus (both free edition 7.5) have reported, after full system scans, "Threat detected - Trojan horse Generic 10.BHES".  The report quotes a file name and has options : Ignore, Move to Vault, Enable access.  The recommendation is to move to virus vault until something can be done, but when I tried that it came back with "not available for this object".

I suppose I'm lucky in that this is the first time I've had what appears to be a serious warning, and I am not sure what to do.

I have AVG, as above, and at the moment am relying on Windows Firewall
and I run CCleaner regularly.  I have Windows XP SP3.

Advice appreciated.

[Carbon Dudeoxide]

I recommend looking here:
http://www.computerhope.com/forum/index.php/topic,46313.0.html

[silkie]

Carbon Dudeoxide - thanks for the link - I had seen it before, but thought it looked a bit complicated.  Anyway, I now have gone through all the steps detailed by evilfantasy (except Posting the Logs), and all the scans run have come up "all clear" - a further run of AVG scan also came up no threats.  I also uninstalled three programs via Add or Remove Programs that were on Major Geek's chaslang's list.

One point - I haven't noticed any odd behaviour by my PC that I can put down to the reported Trojan, so how do I tell if it's been removed or nullifyed?  Can I assume I'm  ok because of the all clear reports from the scans?

Please let my know if Posting the Logs is necessary for a diagnosis.

Thanks again.

[evilfantasy]

Run a HijackThis scan and post the log. That is usually a good indication of any malware.

[silkie]

OK - herewith log -

HijackThis

SaveFile.com[/url][url href="http://savefile.com/files/1694615"]hijackthis.log - Hosted on SaveFile.com[/url]

Hope this come through ok - it took me some time to work things out!

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Looks fine as far as no malware.

We can do some cleanup of your startups to get rid of un-necessaries.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Go to Start > Run and type notepad.exe then click OK

Copy the text in the Code box below and paste it into Notepad.

Code: [Select]

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"TkBellExe"=-
"RealTray"=-
"SunJavaUpdateSched"=-
"swg"=-

In Notepad go to File > Save as...

Next to File name: type fixme.reg Use the dropdown box next to Save as type: and select All files. Save it to the desktop.

There should now be a file on the Desktop that looks like this

Double-click fixme.reg it and allow it to merge with the Registry.

You may not see anything happen but give it a few seconds or so to finish.

Now delete the fixme.reg file from the desktop.

----------

You will want to either upgrade to AVG 8.0 very soon or find another antivirus. AVG 7.5 is said to be ending support next month.

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Important: You Need to Update Windows and Internet Explorer regularly to protect your computer from the malware and other security threats that are on the Internet. Go to Microsoft Windows Update and get all critical updates.

If you are running any Microsoft Office version go to the Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

----------

Make sure all of your security programs are up to date and run scans with them regularly. Turn on the automatic updates in all of them. I can not stress how important it is to keep your antivirus, antispyware and firewall up to date.

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

Concerned about Browser Security? Consider using Mozilla Firefox 3.0 with Adblock Plus and NoScript

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using SiteAdvisor. SiteAdvisor rates sites on business practices and spam. Safety ratings from McAfee SiteAdvisor are based on automated safety tests of Web sites.

SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[silkie]

evilfantasy - Your instructions all followed, thanks for those and other tips and suggestions.

Another query though - Secunia Software Inspector listed as insecure: Adobe Flash Player 9.x (listed twice, as separate programs) and Macromedia Flash Player 6.x (also listed twice),  The separate, and different, links to the updates both led to Adobe website. While trying to sort this out I found that Macromedia was not listed anywhere on Desktop or Add or Remove Programs, and Adobe on Desktop was "empty". Secunia listed Adobe in my system as C:\WINDOWS \SYSTEM32\Macromed\Flash\Flash9e.ocx and Macromedia (1) as C:\WINDOWS\SYSTEM32\Macromed\Flash\flash.ocx - Macromedia (2) as C:\Program Files\Common Files\AOL\Flasha.ocx

Does this mean that there are two identical versions of these two programs (applications?) ?
Should they appear listed somewhere?

Advice appreciated.

[evilfantasy]

Do this to remove all unstable older versions of Flash.

Download the Flash Player Uninstaller and save it to your desktop.

Run the uninstaller program and then reboot your computer to complete the uninstall.

Download and install the latest version of Flash Player

[silkie]

I installed and ran Flash Player Uninstaller and it got rid of the two old versions of Adobe Flash Player and one version of the Macromedia Flash Player 6.x - the other version (installed on system in: C:\Program Files\Common Files\AOL\Flash.ocx) is still on the list as insecure.

I tried a couple of times to uninstall, but it still appears on Software Inspector's list.  Again, I can't find the program listed anywhere.

I reinstalled Adobe Flash Player latest version and that's all ok.

Would it be ok to just ignore - everything else is given the all clear and I'll install the tools that you suggest.

Thanks again for help.

[evilfantasy]

You can go in and manually delete the file Flash.ocx found in

C:\Program Files\Common Files\AOL\Flash.ocx

[silkie]

Now done ok.

I was looking for the wrong name.

Thanks again.

[evilfantasy]

No problem.

Safe surfing.....