0

I'm running Windows 7 Ultimate 64-bit.

I found a file in c:/Users/name/AppData/Local called shanjou.dll

I noticed it when I ran msconfig and had a look through why my startup was taking a long time and this is where I noticed an entry for RunDll32 being executed against shanjou.dll

I ran a few searches on the name but nothing came up. MS Security Essentials doesn't detect anything wrong with it. What should I do next? I have already moved it out of it's location into my own self-made quarantine folder.

4
  • 1
    I made an edit to the title. Feel free to roll back.
    – Dave
    Jan 17, 2013 at 12:54
  • 1
    You could try to do a start-up virusscan (Avast is capable of this) so the OS doesn't have the file in lockdown. Otherwise, try Combofix which is a more agressive scanner.
    – Matthias
    Jan 17, 2013 at 12:55
  • I've already removed it from the boot sequence, I'm just wondering about what else I can do if it's not recognized as a virus. There's every chance it's harmless, but then why would someone copy it to an inconspicuous place like the /AppData/Local folder and add it to the startup programs running with RunDll32. It stinks of virus.
    – warsong
    Jan 17, 2013 at 13:06
  • The accepted answer to this question might be worth your time: superuser.com/questions/100360/… Jan 17, 2013 at 15:32

3 Answers 3

5

Try to upload it to virustotal.com . It will get scanned by 44 different antivirus products. Normally some of the scanners should find it...

7
  • That worked. It's a backdoor trojan. I'm kind of worried now about what else MSE has missed. I thought it was reliable up until today.
    – warsong
    Jan 17, 2013 at 13:15
  • 3
    MSE is quite reliable. You won't find any antivirus thing which does not have false positives and misses some real viruses. (I would not trust for example every positive from ClamAV, it detects too much)
    – Offler
    Jan 17, 2013 at 13:23
  • Well, it missed it today. One miss is enough to lose my trust.
    – warsong
    Jan 17, 2013 at 13:25
  • 1
    @warsong - Which is the reason using a single product is never a good idea. There are lots of ways to expand your security lots of resources you should read also.
    – Ramhound
    Jan 17, 2013 at 15:16
  • 1
    @warsong I think you misunderstand how anti-virus software works. It is your last line of defense, not your first. It's much more important that you keep your machine fully patched, that you don't run as an administrator by default, and that you use common sense when browsing. There will always be a gap between when a virus is released and when AV products are able to detect it. Jan 17, 2013 at 15:22
2

This is an interesting question.

You can't really install another AV program as they often conflict with each other, may be having to uninstall one for another isn't a desirable option.

There are online tools, McAfee used to also let you download a program like Stinger which I've had some success with when sharing this with other AV programs. The question arises of why you should have to, especially if you had paid for an AV.

You also need to be careful of false positives.

3
  • Malwarebytes is a good supplement to a standard AV program.
    – Bigbio2002
    Jan 17, 2013 at 14:21
  • Professional pay because the free tools aren't licensed for corporate environments where the professionals work. Jan 17, 2013 at 15:23
  • @joel that is not quite right. there are some tools like comodo which have the statement that they can be used in prof. environments.
    – Offler
    Jan 17, 2013 at 16:24
0

That could be anything to do with anything, but its good to check it out to be on the safe side. You can upload files you think are suspicious to Kaspersky via this how to guide http://www.ehow.com/how_8528328_submit-files-kaspersky-lab.html

9
  • It looks like the link in that article is outdated, it doesn't have whatever it's describing, but I'll look for something similar.
    – warsong
    Jan 17, 2013 at 13:09
  • 1
    Oh sorry, it looks like they have changed their procedure since I last had to do this. You can try the free virus scan utility labeled 'Kaspersky Security Scan' here kaspersky.com/virus-scanner or ESET's version here eset.com/us/online-scanner You really need a better piece of AV software running than MSE. It's not robust at all. Programs like Kaspersky has a heuristics scanner that can detect infections that have never been identified before and is far more proactive.
    – Simkill
    Jan 17, 2013 at 13:32
  • Already running ESET;s online scanner to see what else MSE missed.
    – warsong
    Jan 17, 2013 at 13:41
  • @Simkill - I have lots of malicious files that MSE would detect that ESET didn't. MSE is pleanty robust has one of the best engines on the market.
    – Ramhound
    Jan 17, 2013 at 15:15
  • @Ramhound MSE is almost completely geared towards anti-malware with a poorly crafted anti-virus element. It's not a good all round solution as its OK with anti-malware but viruses slip in all the time. ESET isn't designed to fight malware, so MSE is always going to pick up on those infections better than ESET as they are more common, but less dangerous. You're better off running Malwarebytes alongside Kaspersky as they won't interfere with each other and will both do what they are designed for very well.
    – Simkill
    Jan 18, 2013 at 12:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .