trojan horse generic 10.POD

Hi, I installed avg 8.0 free yesterday at which point the programme ran a virus scan. It found the above trojan horse in 4 files: One in a programme zip file; one in an email and 2 in two different hard drive restore points, one on my main drive c: and the other on drive d:. There is no indication of the dates of these restore points. I have deleted the programme and the email concerned but is there someway to find the restore points mentioned or would I be better just to purge all restore points on all drives and start again. I take it I would have to run more scans etc before I do a restore point, but I should maybe point out that avg 7.5 found this trojan and said it was deleted. The programme concerned was installed on the pc sometime in March, so this has been aroung since then and I have done plenty of scans between then & now. Superantispyware, spywareblaster, windows defender nor spybot s&d found it at all. Is there some other programme(s) I could be running? Would an HJT scan be of any use that someone could maybe check it for me? Thanks for reading and in advance for any help offered. hedley

Well, that one is easy (hopefully). First the new AVG has had a few problems with false positives so that may be the case here. But since none of these appear to be critical files, I think you should delete the zip file and the two emails, then empty the Recycle Bin and the deleted email folder.

Then right click on your hard drive under My Computer and select Properties and under the General tab, click on Disk Cleanup. Wait for it to finish analyzing your drive, then click on More Options. Under System Restore, click Clean up… This will delete all but the most recent Restore Point. This does stop you from going back further than the most recent, so if your computer is not running fine, you may want to skip this. Malicious code in a Restore Point cannot cause harm, unless you use the Point to restore the computer.

If you scan again and the Trojan appears in System Restore again, you may need to disable System Restore temporarily, then scan again and you should be clean. At this point, you can enable System Restore again.

If the Trojan appears once more, then I think you should refer to the What TheTech HijackThis Log Procedures for complete instructions on running HijackThis, then post a log where instructed. Hopefully the HJT analysts will see something. Please refer to this post so they can catch up, then post back here with a status when done.

That said, I think this is a false positive since all the other programs you mentioned said your system is clean. Still, better safe than sorry.

Hi, thanks for the reply. I did as you suggested and then I ran avg8, superantispyware, spybot s&d, ccleaner & windows defender. A few tracking cookies showed up but the trojan above seems to be gone. Ccleaner found a list of 'issues' in the registry section, but I'm afraid I'm a bit wary of messing with the registry as I don't know what I am doing. Apart from that I cleared everything else that was found. Hopefully, that will be my problem solved. Once again, thanks for the help. Very much appreciated. hedley

Great, I am glad that is cleared up. As for your concerns about the "Issues" in the Registry, you are wise to be concerned. That said, CCleaner is a very conservative cleaner, and I have not had it mess up a computer yet. Rather than go into details, I just had the same conversation with Grampy Pete and his concerns in this thread - skip to my last post on the first page of the thread, then continue from there.