Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

EQNEDT32.EX_1033


  • Please log in to reply
10 replies to this topic

#1 Hermesx

Hermesx

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:17 AM

Posted 06 March 2015 - 08:43 PM

So, I run full system scans on my family PC automatically each day. I have not checked these scans in a while, but I was on the computer today which is uncommon for me to do. I saw that there was an alert from February 5th of this year that there had been a virus detected and automatically moved to the virus chest. Upon searching the name of this virus "EQNEDT32.EXE" I saw that it had limited search results except a few dodgy ones. A dodgy one is better than no information and I saw that this virus turns out to be a severe trojan. So, since avast has automatically quarantined this and malwarebytes has so far (currently running a scan) not found anything, should there be any reason to worry about?

 

If you have any previous knowledge about this infection, whether or not it is a false positive or steps to cleaning my family's PC I'd greatly appreciate your help.

 

Thanks,

Hermesx


I appreciate all the help that anyone ever provides me with. Thank you to everyone that has assisted me in the past. :)


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,662 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:17 AM

Posted 06 March 2015 - 09:48 PM

It could be false positive.

It mostly depends on where the files was/is located.

Legit location: C:\Program Files\Common Files\Microsoft Shared\ EQUATION\EQNEDT32.EXE


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 Hermesx

Hermesx
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:17 AM

Posted 06 March 2015 - 11:03 PM

Mine was located in: C:\ProgramData\Microsoft\OEMOffice14\Office.en.us\OfficeLR.cab|>


I appreciate all the help that anyone ever provides me with. Thank you to everyone that has assisted me in the past. :)


#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,662 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:17 AM

Posted 06 March 2015 - 11:34 PM

It could be another legit location.

Is the file still in Avast chest?


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#5 Hermesx

Hermesx
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:17 AM

Posted 10 March 2015 - 01:50 PM

Yes it is!


I appreciate all the help that anyone ever provides me with. Thank you to everyone that has assisted me in the past. :)


#6 Hermesx

Hermesx
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:17 AM

Posted 10 March 2015 - 03:03 PM

Also, avast just found another file and moved it to chest. It says "HTML:RedirME-inf" and lists it as a Trojan. The other file detected previously was also a trojan so I'm wondering if there is a connection here.

The path for the most recent file that was detected is:

"C:\Users\Herron\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GVXC3B2L\raleighpakistan[1].htm"

Does this mean this was downloaded through my Internet Explorer? (I never use it)


I appreciate all the help that anyone ever provides me with. Thank you to everyone that has assisted me in the past. :)


#7 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,662 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:17 AM

Posted 10 March 2015 - 06:00 PM

This one is located in IE temporary files so it looks like visited some bad site.

As long as Avast caught it you should be fine.

 

As for EQNEDT32.EXE  restore that file from Avast chest and upload it here for security check: https://www.virustotal.com/


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#8 Hermesx

Hermesx
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:17 AM

Posted 11 March 2015 - 02:29 PM

Avast won't let me restore it for some reason.


I appreciate all the help that anyone ever provides me with. Thank you to everyone that has assisted me in the past. :)


#9 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,662 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:17 AM

Posted 11 March 2015 - 07:56 PM

Does Office function just fine?


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#10 Hermesx

Hermesx
  • Topic Starter

  • Members
  • 75 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:17 AM

Posted 13 March 2015 - 09:22 PM

The thing is that I rarely use it. It is extremely rare for me to ever use it except for resume purposes, but I will check.


I appreciate all the help that anyone ever provides me with. Thank you to everyone that has assisted me in the past. :)


#11 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,662 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:17 AM

Posted 14 March 2015 - 12:43 PM

Let me know.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users