[Resolved] Trojan.Win32.Genome.kxn

I ran a Kaspersky scan yesterday and got the following results: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Friday, April 10, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Friday, April 10, 2009 16:06:26 Records in database: 2031846 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Scan statistics: Files scanned: 95361 Threat name: 1 Infected objects: 2 Suspicious objects: 0 Duration of the scan: 03:11:23 File name / Threat name / Threats count C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe Infected: Trojan.Win32.Genome.kxn 1 C:\hp\bin\AUTOPLAY.EXE Infected: Trojan.Win32.Genome.kxn 1 The selected area was scanned. How can I safely remove this Trojan? Thanks.

You have a couple of entries in your log that point to files on your PC that I would like to have checked - if they are still present.

Please go to Jotti's and click on the Browse… button at the top and navigate to the following files in turn, and then click on Submit:

C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe
C:\hp\bin\AUTOPLAY.EXE

When all the scans have been completed, please copy and paste the results into your next reply.

If this site is busy, try VirusTotal: Click the Browse … button, navigate to the file and double click it and then click the Send button.

You may need to set Windows to show All Hidden Files and Folders - Instructions can be found here.
* These files are hidden to stop you accidentally removing something important.
It is advisable to hide them again after you have done. *

Here are the results: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe Scan taken on 14 Apr 2009 01:13:19 (GMT) A-Squared Found Trojan.Win32.Genome!IK AntiVir Found TR/Agent.EAD ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found nothing BitDefender Found Trojan.Generic.178472 ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found Trojan.Win32.Genome.kxn Ikarus Found Trojan.Win32.Genome Kaspersky Anti-Virus Found Trojan.Win32.Genome.kxn NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing C:\hp\bin\AUTOPLAY.EXE Scan taken on 14 Apr 2009 01:17:44 (GMT) A-Squared Found Trojan.Win32.Genome!IK AntiVir Found TR/Agent.EAD ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found nothing BitDefender Found Trojan.Generic.178472 ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found Trojan.Win32.Genome.kxn Ikarus Found Trojan.Win32.Genome Kaspersky Anti-Virus Found Trojan.Win32.Genome.kxn NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Quick Heal Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing

I'm thinking that these are false positives. Will you navigate to C:\hp\bin\AUTOPLAY.EXE, right click the file and select Properties and tell me what you can find out. I suspect that it is a Hewlett Packard file that can be left alone.

Here's what I found: In the "General" tab: Type of file: Application Description: AUTOPLAY Location: C:\hp\bin Size: 36.0 KB (36,864 bytes) Size on disk: 24.0 KB (24,576 bytes) Created: Wednesday, September 12, 2001, 8:30:45 PM Modified: Monday, August 27, 2001, 4:52:06 PM Accessed: Today, April 14, 2009, 7:39:45 PM In the "Scan Results" tab: Scanned by TrendMicro Antivirus plus Antispyware TrendMicro has checked this file for computer viruses and other threats. The results appear below: File name: AUTOPLAY.EXE Scan results: No incidents detected.

I'd say ignore the detections as they are false positives, assuming of course that you have a Hewlett Packard PC.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.