Malware Removal Forums

Symantec suddenly starting to find unnamed trojan horses

lithiumus · 2009-12-08T13:06:05+00:00

Symantec Anti-Virus started to detect "trojan horses" and quarantining legitimate exe's on my laptop. The trojan horses found by symantec were unammed so I'm assuming possible malware. I work in IT Security and do research on bad domains and sometimes get redirected to bad sites. Will need to consider a virtual instance for stuff like this in the future... Thank you in advance! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:58:17 AM, on 2009-12-08 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16915) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\WiFi\bin\S24EvMon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common F

8 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

lithiumus

December 21, 2009, 3:48 PM UTC

I went through my Archive folders and simply deleted everything (why take a chance)... I emptied the deleted folders, compacted it and verified that the archive folder size is now 0.

I'm performing another Kaspersky scan now. Below are the entries from the Symantec Risk log. I can't access the "System Volume Information" directories...

Risk	Action	Filename	Original Location	Logged By	Date

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:48

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.e68908.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:47

Trojan Horse	Quarantined	GetPopupInfo.exe.5b4dcc.tmp	C:\For Burn\Adobe Illustrator CS3\Program Data\4000002800003i\	Auto-Protect scan	2009-12-09 0:45

Trojan Horse	Quarantined	A0021314.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP250\	Auto-Protect scan	2009-12-08 1:12

Trojan Horse	Quarantined	surcodedvd.exe	C:\Program Files\Minnetonka Audio Software\SurCode DVD DTS\	Auto-Protect scan	2009-12-07 20:37

Trojan Horse	Partial	surcodedvd.exe	c:\program files\minnetonka audio software\surcode dvd dts\	Defwatch Scan	2009-12-07 9:30

Trojan Horse	Quarantined	A0019756.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP229\	Scheduled scan	2009-11-18 1:08

Trojan Horse	Quarantined	A0018122.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP212\	Scheduled scan	2009-11-04 10:42

Trojan Horse	Quarantined	A0016443.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP204\	Scheduled scan	2009-10-28 1:10

Trojan Horse	Quarantined	TeamViewer_Setup.exe	C:\Documents and Settings\glau\My Documents\Personal\Software\	Scheduled scan	2009-10-28 1:04

Trojan Horse	Quarantined	TeamViewer_Setup.exe	C:\Documents and Settings\glau\Desktop\Software\Installed\	Scheduled scan	2009-10-28 1:02

Trojan Horse	Quarantined	A0016178.exe	C:\System Volume Information\_restore{FF4B3B50-83E3-4A5F-B273-B341A337A52E}\RP199\	Auto-Protect scan	2009-10-23 0:43

deltalima Admin/Teacher

December 21, 2009, 10:00 PM UTC

Hi lithiumus,

The "System Volume Information" directories are special hidden system folders where the files and other data required to perform System Restore and cannot be accessed via Windows Explorer.

I will give you some instructions (once we have decided that your system is clean) to clear out this folder to ensure nothing remains in there.

ESET online scannner

Please go Here then click on:

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on:
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Now click on:
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on:
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Carolyn MRU Emeritus

December 25, 2009, 7:58 PM UTC

a lack of response,

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.