Anyone heard of SecThought.B?

[Queasy]

I keep getting a message on my PC that I have a SecThought.B trojan horse virus. But, when I run AVG Anti-virus it does not pick up any kind of virus on my PC. I've done a google search on it but haven't found anything.

Thanks for any help.

 

[pyrojunkie]

You got a message that you have the virus, but it didn't come from the Anti-Virus software?

 

[Queasy]

Well, that's the weird thing. A message box pops up on the screen saying I have a the SecThought.B virus. Please run the AVG anti-virus software to remove it. But, when I run AVG it doesn't detect any kind of virus at all on my PC.

 

[pyrojunkie]

So the message is coming from the Anti-Virus software?

 

[Queasy]

Yep. The message box title is AVG Anti-Virus. But that's the weird part. When I actually run AVG it doesn't find any virus!

 

[pyrojunkie]

Does this message pop up at random times or does it pop up at startup?

 

[Queasy]

At random times and at startup. Usually if I leave my PC without any activity for a while it will pop-up.

 

[pyrojunkie]

Your problem is a little wierd. Its apparent this trojan is loading up, so I would recommend checking all programs that run on Startup. Goto RUN, and type "msconfig". Stop any of the programs that you have no clue on why they run at start. If doing so stops something you need just recheck the box so it starts again

 

[helpmeout]

Try this online trojan scan:

http://www.trojanscan.com/

 

[Queasy]

Thanks for the trojan scan link.

Here are the results:

Starting scan at 21:06:07:484...
Scan Memory
Memory not infected
Scan folder: 'C:\', recursive
Unable to scan C:\System Volume Information - Access is denied.
Scan folder: 'D:\', recursive
Unable to scan D:\System Volume Information - Access is denied.
Finished scan at 21:16:04:31
Total number of files is 46197, number of infected files is 0
Average files per second is 77, average file size is 5752081

Now, what is odd is that the AVG popup warning me of the trojan horse listed C:\System Volume Information along with an executable file A00*.exe (I can't remember the exact name and the message hasn't popped up today).

I forgot all about msconfig. I went in there and unchecked some questionable items from bootup. We'll see how it works.

Thanks for the help.

 

[Queasy]

Here's the full file reference given to me in the message window:

C:\System Volume Information\_restore{FV8126FD-3E29-48FB-8859-AC6E447}\RP165\A0029438.exe

I've searched for the executable in regedit and deleted it but am still getting this message. When I do a search in explorer it cannot be found.

 

[lobadobadingdong]

you need to boot to safe mode, delete the executable, remove it from msconfig and the registry, then run antivirus, I'd also recommend running something like spybot while your still in safe mode as it may be spyware linking your machine to the trojen. odds are it's still resident in the background after you delete the file, the little buggers are sneaky like that.