Trojan not removed

AikevanderH

My F-secure scanner finds regularly the following virus:
GEN:Trojan.Heur.JP.wzZ@au. (and some more letters)

F-secure does not remove the virus (if it is one), but goes on detecting it.

My computer runs on Windows 8.1

I am an F-secure user via the Dutch provider www.xs4all.nl

 

Regards, Aike van der Hoeff

Simon

Have you tried scanning with Malwarebytes?

http://www.malwarebytes.org/free/

NikK

A generic Trojan detection is a detection of a file that appears to have trojan-like features or behavior.

Trojans are not Viruses, but I assume the reasons for not sometimes being able to automatically clean them are the same:

 

http://community.f-secure.com/t5/Security-for-PC/Viruses-were-found-but-were-not/ta-p/31309

Rusli

There are many methods to solve this problems. In sequence...

 

Namely...

 

Firstly, I suggesting if you can download free version of malwarebytes and do a Full Scan from this link.

 

http://www.malwarebytes.org/

 

If malwarebytes found nothing, the next option is to download Hitman Pro.

 

From the link below.

 

http://www.surfright.nl/en/downloads/

 

If the above still did not detect any you can download. DrWeb Cure it.  Free Download  And do a Full Scan.

 

http://www.freedrweb.com/cureit/?lng=en

 

 

There are others... which you can try out.

 

Bitdefender Online Scanner.

 

http://www.bitdefender.com/scanner/online/free.html

 

 

 

Otherwise, if any of the above methods did not detect any.

 

I recommend that you download the AVIRA Rescue  System  ISO. From this link. And burn it to a CD-R blank Disc to your DVD Burner.

 

http://www.avira.com/en/download/product/avira-rescue-system

 

or

 

You can use a Kaspersky Rescue CD. Download and Burn it to a CD-R or DVD-R.

 

http://support.kaspersky.com/viruses/rescuedisk#downloads

 

And Do a Full Scan.

 

 

 

 

Note:-

Click on Kudos button to the person who have solve your problems.

AikevanderH

I did the full computer scan, and the online scan. No results.

Rusli

See the link above.

 

Tell you what, download the AVIRA Rescue Disc and copy it to a thumb drive and reboot your computer and do a full scan. Make sure you download the antivirus engine to keep it updated.

 

or Kaspersky Rescue Disc

 

Another thing is that make sure your f-secure qurantine file is empty.

 

And do a full scan again.

 

 

Rusli

To create a bpotable rescue disk on a Thumb Drive.

 

What you have to do is to download the ISO file of AVIRA Rescue Disk or Kaspersky Rescue Disk.

 

Next Download, Linux Pendrive.

 

http://www.pendrivelinux.com/universal-usb-installer-easy-as-1-2-3/

 

And follow the methods here.

 

http://www.ubuntu.com/download/desktop/create-a-usb-stick-on-windows

 

 

 

 

Or if this is too troublesome for you.

 

The quick and easy way is to download the ISO and burn it to an empty CD-R disc.

 

http://www.ubuntu.com/download/desktop/burn-a-dvd-on-windows

 

 

Insert the BURN ISO AVira or Kaspersky Rescue  Disc and reboot the computer and make sure select the DVD option  rom bios setting.

 

Read the documents below ...

 

http://www.avira.com/documents/products/pdf/en/man_avira_rescue_system_en.pdf

AikevanderH

I tried Malwarebyte, started 1 our ago, found nothing

Simon

When F-Secure find this 'trojan', does it tell you where it is on your computer, ie, a path to the file?

NikK

To see the full path to the file:

From the scan results window, try right click on the "infection" and then select Properties...

Simon

I was wondering if the simplest solution might be to find it and delete it manually, providing it doesn't look like it's in a system folder?

Simon

Just another random thought - if an infected file is archived or zipped, and F-Secure cannot deal with it for that reason, if the zip file were to be opened and the rogue file extracted, would F-Secure instantly zap it before it got a chance to execute?

NikK

Yes, the real-time scan will detect it.

 

"By default, compressed or archive files, such as ZIP files, are not scanned in real time. F-Secure's antivirus products scan the archive files automatically once you attempt to extract or execute their content."

 

From http://community.f-secure.com/t5/Security-for-PC/Testing-your-virus-protection/ta-p/18294

Simon

So then, it should, in theory, be safe to open a known infected archived file, for F-Secure to dispose of it. Anyone want to try?

NikK

If you're unsure, first test with the Eicar files mentioned in the link I posted. You can test an executable file "eicar.com", a zip file including the eicar file, nested archives(a zip file including another zip file that includes eicar.com).

 

Or the coolest: you can create an eicar file yourself using a text editor.

AikevanderH

---

@Simon wrote:
When F-Secure find this 'trojan', does it tell you where it is on your computer, ie, a path to the file?

---

no it does not

 

AikevanderH

---

@NikK wrote:

To see the full path to the file:

From the scan results window, try right click on the "infection" and then select Properties...

---

I'll try this, the next time F-secure finds the virus

NikK

You could try this: http://community.f-secure.com/t5/Security/F-Secure-Online-Scanner-All-You/m-p/42449

It has a "DeepClean" function.

 

Or maybe: http://www.microsoft.com/Security/Scanner/en-us/default.aspx

AikevanderH

Thanks to everyone who wrote messages and tried to find answers.
I tried a couple of solutions, but none of them worked, and others were too complicated (in my opinion).
Yesterday I decided to re-install Windows 8.1. First 8.0, then updates and then on to 8.1. All is clean now.

 

Regards, Aike van der Hoeff