Question about trojan horse generic9

sillybuttons™ · 03-04-2008, 04:08 AM

Hi all. First I'd like to thank brook1967, basselope and Dunedin for their assistance last week. Cheers.

AVG just told me in the last scan that I was infected with Trojan horse Generic9.BANS and that it had successfully deleted the infected file (cleaner.exe) which was in my program files. I had a google about and could not find the trojan with the .BANS extension but found numerous others. i.e. .AKUT and . ACFR. I'm presuming they are all the same trojan.
So, I read as much as I could find and a lot of people infected with this said it came back after a day or so after disinfection. But, these people also said that their antivirus programs could not deal with it and removal had to be done manually. Most of these people were also using AVG. On the flip side a lot of other reports suggest this may be a false positive and AVG are supposed to be including a fix in a future update. Which also concerns me because its already been deleted and if it was indeed a FP what has been deleted?

Does anyone know if I will get reinfected or am I still infected or am I clean? I didn't notice any performance issues before AVG found this infection and I had noticed the cleaner.exe file appeared from nowhere in my program files about a week ago, it may have been there longer. I kept meaning to check it out but never got round to it. Laziness I suppose. Oh and out of curiosity does anyone know what this trojan does?

I'm running XP home w/ SP2

Sorry i put this in the wrong forum. Thanks for moving it mods. (I'm new here and I'm still finding my way around)

**Glaswegian** · 03-04-2008, 04:57 AM

Hi

Cleaner.exe is a common file name, used in legit applications as well as malware. I would run scans with programmes such as Ad-Aware 2007 and Spybot - Search & Destroy. Then check with an online scanner such as Panda ActiveScan or Kaspersky WebScanner. If they don't find anything then you're likely clean. If you would like us to check your system then start here

http://www.techsupportforum.com/secu...sting-log.html

Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply.

Also have a look here for general security tips and suggestions

PC Safety and Security--What Do I Need?

sillybuttons™ · 03-04-2008, 06:39 AM

All seems fine. If there are any problems I'll let you know in this thread. Thanks

03-04-2008, 04:08 AM	#1 (permalink)
sillybuttons™ Registered User Join Date: Feb 2008 Posts: 7 OS: xp service pack 2	Question about trojan horse generic9 Hi all. First I'd like to thank brook1967, basselope and Dunedin for their assistance last week. Cheers. AVG just told me in the last scan that I was infected with Trojan horse Generic9.BANS and that it had successfully deleted the infected file (cleaner.exe) which was in my program files. I had a google about and could not find the trojan with the .BANS extension but found numerous others. i.e. .AKUT and . ACFR. I'm presuming they are all the same trojan. So, I read as much as I could find and a lot of people infected with this said it came back after a day or so after disinfection. But, these people also said that their antivirus programs could not deal with it and removal had to be done manually. Most of these people were also using AVG. On the flip side a lot of other reports suggest this may be a false positive and AVG are supposed to be including a fix in a future update. Which also concerns me because its already been deleted and if it was indeed a FP what has been deleted? Does anyone know if I will get reinfected or am I still infected or am I clean? I didn't notice any performance issues before AVG found this infection and I had noticed the cleaner.exe file appeared from nowhere in my program files about a week ago, it may have been there longer. I kept meaning to check it out but never got round to it. Laziness I suppose. Oh and out of curiosity does anyone know what this trojan does? I'm running XP home w/ SP2 Sorry i put this in the wrong forum. Thanks for moving it mods. (I'm new here and I'm still finding my way around) Last edited by sillybuttons™; 03-04-2008 at 04:34 AM.

03-04-2008, 04:57 AM	#2 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,512 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	Re: Question about trojan horse generic9 Hi Cleaner.exe is a common file name, used in legit applications as well as malware. I would run scans with programmes such as Ad-Aware 2007 and Spybot - Search & Destroy. Then check with an online scanner such as Panda ActiveScan or Kaspersky WebScanner. If they don't find anything then you're likely clean. If you would like us to check your system then start here http://www.techsupportforum.com/secu...sting-log.html Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply. Also have a look here for general security tips and suggestions PC Safety and Security--What Do I Need? __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner

03-04-2008, 06:39 AM	#3 (permalink)
sillybuttons™ Registered User Join Date: Feb 2008 Posts: 7 OS: xp service pack 2	Re: Question about trojan horse generic9 All seems fine. If there are any problems I'll let you know in this thread. Thanks