Just Installed Avira Antivir Free-found Trojan

Discussion in 'other anti-virus software' started by bgfalconboy, Dec 20, 2007.

Thread Status:
Not open for further replies.
  1. bgfalconboy

    bgfalconboy Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    226
    Got rid of Avast has it had web security guard issues with yahoo mail and what not and antivir seemingly a lot lighter. So not long after installing it on my system in detected this Trojan called TR/Gorshok.A, file named A0036013.dll , I quarantined it promptly then deleted it , then next time I booted my laptop I got the same message from antivir that it had found this trojan. Any particular reason why this message would show up again if I deleted this thing?
     
  2. C.S.J

    C.S.J Massive Poster

    Joined:
    Oct 16, 2006
    Posts:
    5,029
    Location:
    this forum is biased!
    1. probably an FP
    2. avira has poor removal, after reboot... its there again.

    check the file with virscan.org
     
  3. Londonbeat

    Londonbeat Registered Member

    Joined:
    Sep 21, 2006
    Posts:
    350
    Running a full scan with Antivir in safemode might get rid of it. If you've still got a copy of the file then send it to avira to confirm it's not a false positive. TR/Gorshok.A is a signature detection so it might not be an FP.
     
  4. Mele20

    Mele20 Former Poster

    Joined:
    Apr 29, 2002
    Posts:
    2,495
    Location:
    Hilo, Hawaii
    Is System Restore turned on? If so, disable System Restore, reboot the computer. This will delete all restore points. The nasty is probably in System Restore. After rebooting, make a new restore point.
     
  5. bgfalconboy

    bgfalconboy Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    226

    Okay, too send this to Avira do I click the "send to" button with the avira umbrella logo on it on the antivir interface? Thanks.
     
  6. Londonbeat

    Londonbeat Registered Member

    Joined:
    Sep 21, 2006
    Posts:
    350
    You could restore the file to your desktop (in a password protected zip) and send it to virus[@]avira.com, or upload it here from it's location.
     
  7. bgfalconboy

    bgfalconboy Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    226
    Here's what it said in the source panel of avira. C:\System Volume Information\_restore{61BQAEB9-0158-489F-9FFA-CA033D1A8B0A}RP353\A0036013.dll

    Hope I got that all right. I'm not sure how to even find this file on my pc though. Where would System Volume Information even be?
     
  8. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    System Volume Information Folder
     
  9. Londonbeat

    Londonbeat Registered Member

    Joined:
    Sep 21, 2006
    Posts:
    350
    If its system restore file then probably best to follow mele20's advice above - it will be gone after reboot and cannot infect you from system restore.
     
  10. ccsito

    ccsito Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    1,579
    Location:
    Nation's Capital
    The System Volume Information is a "hidden" folder on the main hard drive. it is "hidden" to prevent a user from inadvertantly deleting information in it since System restore would use it.

    You have to change your file viewing option to show hidden folders.
     
  11. rollers

    rollers Registered Member

    Joined:
    Sep 13, 2004
    Posts:
    439
    just turn off system restore and then turn it back on again. All the old ones will be deleted and the virus will be gone.
    You can find system restore through control panel, system.
     
  12. bgfalconboy

    bgfalconboy Registered Member

    Joined:
    Jan 10, 2006
    Posts:
    226
    All righty did the turn off system restore thing and I'll turn it back on here in a few. After a reboot ,hopefully that'll take care of it thanks guys.
     
  13. solcroft

    solcroft Registered Member

    Joined:
    Jun 1, 2006
    Posts:
    1,639
    Just for the record, I've seen users complaining of an FP on a Lotus dll component two days ago. The name Avira reported it as? TR/Gorshok.
     
Loading...
Thread Status:
Not open for further replies.