Solved Zemana detected Ghoksa.A!Neng Trojan

smokeyjoe

Level 1
Thread author
Verified
Dec 25, 2016
21
Hi - this is a copy and paste of my post from a recent thread of someone else having the same issue:

SOLVED - Xemana Antilogger Running but stuck on Ghoksa.A!Neng

Running Windows 7, ran a quick scan with Zemana and it detected
Adware: Win 32/Ghokswa.A!Neng in folder - c:\program files (x86)\temp - pretty much the exact issue of the linked thread.

I don't believe it hung up but I was able to quarantine and everything seemed fine. The Zemana database needed to be updated prior to scan and I updated that after the scan/quarantine. I only mention that because I thought that may have contributed to the next issue: several hours later, KAV 2017 detected malware - ZAM .exe. So I shut down, removed all other HD's, internet access and rebooted.

Kaspersky was not able to remove the "infection" and I was unable to select any programs or desktop links while it was in process of trying to fix the issue.. It was stuck on the removal process - is t normal that system files and such will generate errors during malware removal? I've not had the pleasure of having to do this before; while Kaspersky was seemingly hung up on removing the "infected" ZAM.exe, I tried to open up Firefox and other programs and was met with several errors stating some .dll files were inaccessible (not sure of the exact error/verbiage here).

I restarted several times with the same results. I rebooted to Safe Mode and was able to uninstall Zemana (KAV was not running), then reboot normally and run a scan with Kaspersky and everything was "ok".

Attached the FRST logs for review. I'm curious what these mean. Some items are marked <== ATTENTION.. is that good? LOL o_O
 

Attachments

  • Addition.txt
    37.3 KB · Views: 5
  • FRST.txt
    21.4 KB · Views: 3

TwinHeadedEagle

Level 41
Verified
Mar 8, 2013
22,627
Hello,

Regarding the Ghokswa.A detecting that was fixed. Regarding the Kaspersky's detection, that is a False Positive.

Your computer isn't infected.
 
  • Like
Reactions: mrgatsby

smokeyjoe

Level 1
Thread author
Verified
Dec 25, 2016
21
Appreciate it.. so the logs I uploaded look fine? I'm wondering because there are some things in there that, to my virgin eyes, I don't understand and can be interpreted as fishy.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top