Virus Suspect

[jdow]

From: "Michael Miles" <mmamiga6 at gmail.com>
Sent: Saturday, 2010/April/17 10:14
>
> this is what I find with avira
> I'm just scanning and not doing anything with this file or files
>
>
>
> file: /home/amiga5/.wine-x86_64/drive_c/windows/twain.dll
>     last modified on  date: 2010-03-09  time: 14:16:14,  size: 1032 bytes
>     ALERT: TR/Crypt.XPACK.Gen2 ; trojan ; Is the Trojan horse
> TR/Crypt.XPACK.Gen2
>     ALERT-URL: http://www.avira.com/en/threats?q=TR%2FCrypt%2EXPACK%2EGen2
>
>
>
>  file: /home/amiga5/.wine-x86_64/drive_c/windows/system32/dosx.exe.XXX
>     last modified on  date: 2010-03-09  time: 14:16:14,  size: 1032 bytes
>     ALERT: TR/Crypt.XPACK.Gen2 ; trojan ; Is the Trojan horse
> TR/Crypt.XPACK.Gen2
>     ALERT-URL: http://www.avira.com/en/threats?q=TR%2FCrypt%2EXPACK%2EGen2
>
>
>  file: /home/amiga5/.wine-x86_64/drive_c/windows/system32/dsound.vxd.XXX
>     last modified on  date: 2010-03-09  time: 14:16:14,  size: 1032 bytes
>     ALERT: TR/Crypt.XPACK.Gen2 ; trojan ; Is the Trojan horse
> TR/Crypt.XPACK.Gen2
>     ALERT-URL: http://www.avira.com/en/threats?q=TR%2FCrypt%2EXPACK%2EGen2
>
>
>  file: /home/amiga5/.wine-x86_64/drive_c/windows/system32/ddhelp.exe.XXX
>     last modified on  date: 2010-03-09  time: 14:16:14,  size: 1032 bytes
>     ALERT: TR/Crypt.XPACK.Gen2 ; trojan ; Is the Trojan horse
> TR/Crypt.XPACK.Gen2
>     ALERT-URL: http://www.avira.com/en/threats?q=TR%2FCrypt%2EXPACK%2EGen2
>
>
> file: /home/amiga5/.wine-x86_64/drive_c/windows/system/ddeml.dll.XXX
>     last modified on  date: 2010-03-09  time: 14:16:14,  size: 1032 bytes
>     ALERT: TR/Crypt.XPACK.Gen2 ; trojan ; Is the Trojan horse
> TR/Crypt.XPACK.Gen2
>     ALERT-URL: http://www.avira.com/en/threats?q=TR%2FCrypt%2EXPACK%2EGen2
>
>
> file: /home/amiga5/.wine-x86_64/drive_c/windows/winhelp.exe.XXX
>     last modified on  date: 2010-03-09  time: 14:16:14,  size: 1032 bytes
>     ALERT: TR/Crypt.XPACK.Gen2 ; trojan ; Is the Trojan horse
> TR/Crypt.XPACK.Gen2
>     ALERT-URL: http://www.avira.com/en/threats?q=TR%2FCrypt%2EXPACK%2EGen2
>
>
> Are these false alerts or are they real?
>
> Considering they are all the same trojan I would suspect false alert.
>
> I could be wrong...Avira and Bitdefender both found these.... Clamav did
> not find any.

If you haven't installed an XP set of files under Wine for your winhelp.exe
and the like - I do believe you have been infected - somehow. What do you
run in your Wine? And do you know what the .XXX added to the files is?
Double check that they don't track back to the wine install. And if they
don't nukem or reinstall wine.

Those are files with standard Windows names and .XXX suffixes. They
probably found their way into your wine setup. I don't know if they have
been unpacked and installed except for twain.dll. They all have the same
modified date. That is suggestive of having a malware infection. (Twain.dll
on a fully up to date XP Pro install is dated back in 2004/08/04 and is
93k on disk.)

{^_^}