X
Tap here to go to the mobile version of the site.

Support Forum

How to remove Trojan Exploit-WinampPLS.b.gen from Firefox

Posted

Looking for any help removing a Trojan that seems to be effecting Firefox. Anti virus continues to detect Exploit-WinampPLS.b.gen. I used online support from Mcafee, they remove a profile entry from Firefox, rescanned, and it was gone, but it appears to return shortly after removed. I have tried resetting Firefox, deleting cash and reinstalling Firefox, it keeps coming back. Any ideas?

Looking for any help removing a Trojan that seems to be effecting Firefox. Anti virus continues to detect Exploit-WinampPLS.b.gen. I used online support from Mcafee, they remove a profile entry from Firefox, rescanned, and it was gone, but it appears to return shortly after removed. I have tried resetting Firefox, deleting cash and reinstalling Firefox, it keeps coming back. Any ideas?

Chosen solution

Run most or all of the listed scanners.

Read this answer in context 0

Additional System Details

Installed Plug-ins

  • Adobe PDF Plug-In For Firefox and Netscape 11.0.10
  • GEPlugin
  • Google Update
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 11.31.2 for Mozilla browsers
  • McAfee MSC FF plugin DLL
  • McAfee Virtual Technician plugin
  • The plug-in allows you to open and edit files using Microsoft Office applications
  • Office Authorization plug-in for NPAPI browsers
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • Shockwave Flash 17.0 r0
  • 5.1.30514.0

Application

  • Firefox 36.0.4
  • User Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0
  • Support URL: https://support.mozilla.org/1/firefox/36.0.4/WINNT/en-US/

Extensions

  • HP Smart Web Printing 4.51 (smartwebprinting@hp.com) (Inactive)
  • McAfee Security Scan Plus 1.0 ({e4f94d1e-2f53-401e-8885-681602c0ddd8}) (Inactive)
  • McAfee SiteAdvisor 3.7.2 ({4ED1F68A-5463-4931-9384-8FFF5ED91D92}) (Inactive)

Javascript

  • incrementalGCEnabled: True

Graphics

  • adapterDescription: ATI Radeon HD 2600 XT
  • adapterDescription2:
  • adapterDeviceID: 0x9588
  • adapterDeviceID2:
  • adapterDrivers: aticfx32 aticfx32 atiumdag atidxx32 atiumdva
  • adapterDrivers2:
  • adapterRAM: 256
  • adapterRAM2:
  • adapterSubsysID: 09901462
  • adapterSubsysID2:
  • adapterVendorID: 0x1002
  • adapterVendorID2:
  • clearTypeParameters: Gamma: 2200 Pixel Structure: R ClearType Level: 100 Enhanced Contrast: 400
  • direct2DEnabled: True
  • directWriteEnabled: True
  • directWriteVersion: 6.2.9200.16492
  • driverDate: 4-19-2011
  • driverDate2:
  • driverVersion: 8.850.0.0
  • driverVersion2:
  • info: {u'AzureCanvasBackend': u'direct2d', u'AzureFallbackCanvasBackend': u'cairo', u'AzureContentBackend': u'direct2d', u'AzureSkiaAccelerated': 0}
  • isGPU2Active: False
  • numAcceleratedWindows: 1
  • numTotalWindows: 1
  • webglRenderer: Google Inc. -- ANGLE (ATI Radeon HD 2600 XT Direct3D9Ex vs_3_0 ps_3_0)
  • windowLayerManagerRemote: True
  • windowLayerManagerType: Direct3D 11

Modified Preferences

Misc

  • User JS: No
  • Accessibility: No
Scribe 725 solutions 3456 answers

Helpful Reply

Hi, try working through Troubleshoot Firefox issues caused by malware, and please be aware that different programs sometimes remove different malware, so you may need to run several of them.

Hope that will help.

Hi, try working through [[Troubleshoot Firefox issues caused by malware]], and please be aware that different programs sometimes remove different malware, so you may need to run several of them. Hope that will help.
FredMcD
  • Top 10 Contributor
4248 solutions 59432 answers

Chosen Solution

Run most or all of the listed scanners.

Run most or all of the listed scanners.
jscher2000
  • Top 10 Contributor
8700 solutions 71113 answers

Does the scan show exactly where the entry is on your hard drive?

From a brief search, it appears this trojan is designed to exploit an old version of the Winamp program. Hopefully if you use Winamp you have updated it to the latest version.

Does the scan show exactly where the entry is on your hard drive? From a brief search, it appears this trojan is designed to exploit an old version of the Winamp program. Hopefully if you use Winamp you have updated it to the latest version.