Can someone help me with this Virus that my PC just found?

Squall429 · 11-05-2009, 09:44 PM

Ok, guys. I have AVG 8.5 and my Web Shield found a Trojan Horse Generic15.AOXE. I don't know what the hell it is, but it was found in here.

C:\WINDOWS\system32\svchost.exe

I ran a Virus Scan, it didn't even find it.

Hell, I EVEN ran a virus scan on the file ITSELF. And it didn't find it. It keeps popping on my screen, every 2 mins or so and it's getting annoying as hell. All it says is Close. And it keeps popping up every 2 minutes. Does anyone know what I can do to stop this...? Thanks in Advance.

-Squall

cowboycalstar · 11-05-2009, 09:46 PM

if you had a cloud picture, i'd say reformat, but since you don't, use either SuperAntiSpyware or MalwareBytes' Anti Malware and see what they do for you. i'm sure some of the other members can give you more info. let me google that for you and see what i find.

EDIIIIIT: What is C:\WINDOWS\system32\svchost.exe - Security Virus here's a forum talking about the scvhost.exe. I couldn't find anything about the generic aoxe file. sorry.

slowman · 11-05-2009, 09:46 PM

svchost is a normal system process.

I don't know what to tell you about removing a virus since I just reinstall my OS when I get a virus.

Squall429 · 11-05-2009, 09:48 PM

Quote:

Originally Posted by cowboycalstar

if you had a cloud picture, i'd say reformat, but since you don't, use either SuperAntiSpyware or MalwareBytes' Anti Malware and see what they do for you. i'm sure some of the other members can give you more info. let me google that for you and see what i find.

Haha right on! I hate Cloud x.x And do I have to pay money for those? Cause I'm tired of getting ripped off of a scan, then when I wanna remove it it says. PURCHASE YOUR LICENSE! -_-...

cowboycalstar · 11-05-2009, 09:50 PM

Quote:

Originally Posted by Squall429

Haha right on! I hate Cloud x.x And do I have to pay money for those? Cause I'm tired of getting ripped off of a scan, then when I wanna remove it it says. PURCHASE YOUR LICENSE! -_-...

nah, those are free. Geek9 told me about SAS and slowman told me about malwarebytes. hasn't charged me anything for removing stuff and they detect files that even Spybot misses

Squall429 · 11-05-2009, 09:51 PM

Quote:

Originally Posted by cowboycalstar

nah, those are free. Geek9 told me about SAS and slowman told me about malwarebytes. hasn't charged me anything for removing stuff and they detect files that even Spybot misses

Hmm.. I know that it's not a virus..but if I get that Virus Total thing, it'll see if it's clean, then force AVG to update that? o.o

Product F(RED) · 11-05-2009, 09:59 PM

Here's the thing. Some viruses embed themselves in normal system processes, and some alias themselves to appear as normal system processes. I was actually going to recommend the same tools cowboycalstar recommended as they're very good with catching these things. They're both free and very thorough. AVG is alright at preventing things from getting in (I use it as well), but use Malwarebytes Anti-Malware once you're infected.

If the virus has done enough damage, I'd say reformat. It's like cancer, no matter how much you think you removed, there's always a bit left that can redevelop.

Squall429 · 11-05-2009, 10:08 PM

Well I scanned the file and this is what I got. Can someone tell me if it's good? Because I'm still getting that annoying pop up from AVG x.x

Virustotal. MD5: 27c6d03bcdb8cfeb96b716f3d8be3e18

cowboycalstar · 11-05-2009, 10:13 PM

<del> well it's a very new virus...which is reason to update my AV definitions.... thanks

apparently you just got it today, i don't know where you got it from, but it probably was a bad link or something. if you use firefox, you should get the plug-in called NoScript. it's tops on securing everything by disabling java and flash on all sites. you can make it so you can allow certain sites that are known and trusted.

dunno how you got it, but on the interwebs, as in life only the strong survive....i mean, be careful where you tread. you never know what you're going to catch </del>

LOL DISREGARD THAT that's that file that you need. click that link i gave you in my first post and read up on it

Squall429 · 11-05-2009, 10:16 PM

So..am I screwed then...? X.X

Also I think I know what might have caused it. Me and my friend were playing a Private Ragnarok online server, and yesterday it stopped working and I checked to see the website and suddenly it sent me to Meatspin -_-... So maybe that was it x.x

cowboycalstar · 11-05-2009, 10:17 PM

Quote:

Originally Posted by Squall429

So..am I screwed then...? X.X

Also I think I know what might have caused it. Me and my friend were playing a Private Ragnarok online server, and yesterday it stopped working and I checked to see the website and suddenly it sent me to Meatspin -_-... So maybe that was it x.x

lol yeah that might do it

Squall429 · 11-05-2009, 10:18 PM

Well I'm updating to AVG 9.0 right now. You think that'll fix it?

cowboycalstar · 11-05-2009, 10:20 PM

like fred said, avg will detect it but the other two progs will *hopefully* take care of it. y'know what? just come into the chat room, cause that's what this is turning in to

Geek9 · 11-05-2009, 10:30 PM

open up your task manager and look for processes named like this b.exe or c.exe if you find em, manually remove them.

Squall429 · 11-05-2009, 11:23 PM

Well that's odd. I installed the new AVG and changed the Firewall settings and it stopped o.o