Trojan:Win32/Osam!rts feedback RRS feed

  • Question

  • Hey,

    Don't think it's not out in the wilds already.  MSE found it on my computer after downloading SIW 2011 (System Information for Windows) file.  As soon as I clicked on the file to download, MSE popped up and the threat was detected.  AI had to either Quarantine, Remove or Allow the threat or I couldn't do nothing on the computer.

    I downloadede the program from CNET, and the authors website.  I sent the file to MS, and they said they checked it and found nothing there, and I also contacted the author directly who informed that it was virus free.

    I also use Avast, Iobit Malware Fighter, Windows Firewall, SpyBot, TeaTimer, and whatever other programs similtaneously for ultimate protection, and I have never had a trojan or virus or anything get through them before.  Alll these programs, and it was only MSE that detected it.

    I selected to remove the threat in MSE, BUT... now, it keeps showing up on my system whether I click on that particular program I downloaded or not.  AND, it keeps showing up in the same place!!  It shows up in file:C:\Windows\Temp\_avast_\unp*********.tmp files.  The *'s I put here are actually numbers in the TMP file, always diffrent numbers, but always 9 numbers after the UNP.  That is the only place it shows up, but avast did not find it, MSE did!!!

    I even tried to find the TMP files using Windows Explorer, but they don't show anything in the _avast_ folder except a text document called Webslock, and that shows 0 bytes in size.

    I just got this thing yesterday, did not have nothing before then, but now I can't get rid of it when I click Remove in MSE.  It just keeps coming back, and I don't know if it's doing anything or not.

    I again sent Microsoft the files to let them check them out, but I'm not sure the trojan is in there.  I did scans with several different programs, and they chow up clean... EVEN with MSE if I scan the file directly.

    Go figure!!



    Saturday, July 2, 2011 5:05 PM

All replies

  • This forum is for a blog software called Windows Live Writer. For help in Windows Security Essentials, visit answers.microsoft.com.

    The following is signature, not part of post
    Please mark the post answered your question as the answer, and mark other helpful posts as helpful, so they will appear differently to other users who are visiting your thread for the same problem.
    Visual C++ MVP
    Thursday, July 21, 2011 9:31 PM
  • I'm also having exaclty the same problem. What I have found was that the unp*****.tmp files are needed to avast and they are relater with avast scans / unpacking MSE is the only one antivirus that detects a trojan on it, so i guess its a false positive. try to remove avast and all its parts with avast uninstall utility http://www.avast.com/uninstall-utility, (Usefull when you have millions of unp*.tmp files) but that wont fix the MSE alerting.. so  i guess i  have to tell MSE to allow those files >.<

    Sunday, December 11, 2011 5:04 PM