Result of AVG Scan

[David H. Lipman]

From: "Terry C" <tcasson@blueyonder.co.uk>

| Hi all,
|
| Can any one advise if the following AVG result is a high risk item please
| for friend.
|
| Showing as: Trojan Horse PSW.Banker3.jpx
|
| The pc has not been online since the previous AVG scan a couple of days ago.
| Any advice would be really appreciated.
|
| Terry :O)
|

What is the fully qualified name and path to the file(s) deemed infected with this password
stealing Trojan ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Terry C]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:ZOsZh.3005$zE.523@trnddc03...
> From: "Terry C" <tcasson@blueyonder.co.uk>
>
> | Hi all,
> |
> | Can any one advise if the following AVG result is a high risk item
> please
> | for friend.
> |
> | Showing as: Trojan Horse PSW.Banker3.jpx
> |
> | The pc has not been online since the previous AVG scan a couple of days
> ago.
> | Any advice would be really appreciated.
> |
> | Terry :O)
> |
>
> What is the fully qualified name and path to the file(s) deemed infected
> with this password
> stealing Trojan ?
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

Hi David,

The path was as follows:

c:\Documents and Settings\****\My Documents\Laptop\Ext HD\PSP Extras

and it turns out it was a Part01 of a .rar file of a program for Paint Shop
Pro. The executable part.

She has just browsed down to the particular folder and that part01 is now
missing, presumably after being deleted by AVG. What she thought odd was
that the folder had been put onto her laptop approx 2.5 years ago, and onto
her pc three months ago, and has only shown up now, but I guess it's the
latest definitions that have come up trumps. The folder has basically sat
there all this time, but at no point has the file been extracted.

Thanks again,

Terry :O)

[David H. Lipman]

From: "Terry C" <tcasson@blueyonder.co.uk>


| Hi David,
|
| The path was as follows:
|
| c:\Documents and Settings\****\My Documents\Laptop\Ext HD\PSP Extras
|
| and it turns out it was a Part01 of a .rar file of a program for Paint Shop
| Pro. The executable part.
|
| She has just browsed down to the particular folder and that part01 is now
| missing, presumably after being deleted by AVG. What she thought odd was
| that the folder had been put onto her laptop approx 2.5 years ago, and onto
| her pc three months ago, and has only shown up now, but I guess it's the
| latest definitions that have come up trumps. The folder has basically sat
| there all this time, but at no point has the file been extracted.
|
| Thanks again,
|
| Terry :O)
|

Please identify the EXACT file in the RAR file and extract it.


Please submit a sample of the extracted file to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

You can also submit a suspect, one at a time, via the following email URL...
mailto:scan@virustotal.com?subject=SCAN

When you get the report, please post back the exact results.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Terry C]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:8ENZh.2339$KP1.777@trnddc02...
> From: "Terry C" <tcasson@blueyonder.co.uk>
>
>
> | Hi David,
> |
> | The path was as follows:
> |
> | c:\Documents and Settings\****\My Documents\Laptop\Ext HD\PSP Extras
> |
> | and it turns out it was a Part01 of a .rar file of a program for Paint
> Shop
> | Pro. The executable part.
> |
> | She has just browsed down to the particular folder and that part01 is
> now
> | missing, presumably after being deleted by AVG. What she thought odd was
> | that the folder had been put onto her laptop approx 2.5 years ago, and
> onto
> | her pc three months ago, and has only shown up now, but I guess it's the
> | latest definitions that have come up trumps. The folder has basically
> sat
> | there all this time, but at no point has the file been extracted.
> |
> | Thanks again,
> |
> | Terry :O)
> |
>
> Please identify the EXACT file in the RAR file and extract it.
>
>
> Please submit a sample of the extracted file to Virus Total --
> http://www.virustotal.com/flash/index_en.html
> The submission will then be tested against many different AV vendor's
> scanners.
> That will give you an idea what it is and who recognizes it. In addition,
> unless told
> otherwise, Virus Total will provide the sample to all participating
> vendors.
>
> You can also submit a suspect, one at a time, via the following email
> URL...
> mailto:scan@virustotal.com?subject=SCAN
>
> When you get the report, please post back the exact results.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>

Hi David,

Thanks again for your reply. The file was named Splat\Splat~Full~Set
up.Part01.exe which was deleted automatically at the end of the AVG scan.

It was the first of 12 rar file parts, but seeing as the rest would be no
good without the launcher (Part01) to rebuild the whole file again, she has
deleted the folder. So am unable to extract :O(

Splat is a plug-in for Jasc's Paint Shop Pro.

She has, however, got a copy of the folder on a dvd-r, and although she is
loathe to copy it back onto her pc, she was going to see if she can browse
to it on the dvd and try send to the virustotal.com site you listed above.

Highest regards,

Terry :O)