Not sure if a virus was removed

Question

I am running AVG, Spybot and Malwarebytes AM. The resident shield in AVG detected a trojan horse (BackDoor.Generic12.BPKA) in the file WINDOWS\System\driveasyncmac.sys - AVG has indicated this is a white listed file.

I have run my AV programs and they haven't located any more viruses or the same virus again, also Malwarebytes AM has not indicated it has located anything in the registry files etc.

My questions ;

1. Is the virus deleted ? Can / How do I delete / fix the whitelisted file ?

2. The computer in question is a laptop, it is connected via a router to my desktop and one other laptop, I have scanned these other computers and nothing has been located, are they ok ? Can a virus transfer over the router ?

Any other info would be greatly appreciated, I have searched all over the internet and read a lot of articles, all with different suggestions.

Answer 1

In answer to your first question, if you have run a variety of anti-virus programs then the virus has probably been deleted. You can try to fix the file by repairing your Windows installation.

However, as there is a continual arms race between the virus writers and anti-virus software writers the only way to be truly sure that it's gone is to reformat your hard drive and reinstall. However, I would be the first to admit that that might be over the top in this situation.

To answer your second question, a virus will be able to transfer over the router if it's written in the "right" way.

There are two main methods that a virus/trojan can propagate:

1. It could scan the network for other computers and copy it's self to those.

2. Get someone to do the copying for it.

Option 2 is by far the easiest option. You don't have to try and bypass firewalls, negotiate restricted access rights etc. If you can get a human to copy and run the malware you can pretty much guarantee that you can infect a computer.

Obviously if the user is running under restricted rights or has anti-virus software running then it will be harder, but you can get round both of these by convincing the human that the file is something they want to run.