Apache OpenOffice Community Forum

Hi,
I hope someone can help me. My AV detected a trojan with the salhelper3MSC.dll file and quarantined it so now I can't open or start "Open Office" I think there was more than just this one file infected but it is the only one I was able to write down. The name of the supposed virus is Trojan.Win32.Generic!BT and is deemed "High Risk. I downloaded Version 3.2 on Feb 1, and my AV program detected a problem just yesterday. Is this truly a virus? If so, is there a clean version some where?
Thank you!

Ad-Aware Pro ver 8.2.0 (Lavasoft) detecked trojan horses (Trojan.Win32.Generic!BT) in C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll

also deteckted:
helplinkermi.dll (Trojan.Win32.Generic!BT (10112520)) - C:\Program Files\OpenOffice.org 3\program\helplinkermi.dll (Trojan.Win32.Generic!BT)
unordfmi.dll (Trojan.Win32.Generic!BT (39878664)) - C:\Program Files\OpenOffice.org 3\program\unordfmi.dll (Trojan.Win32.Generic!BT)
and
salhelper3MSC.dll (Trojan.Win32.Generic!BT (10112720)) - C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll (Trojan.Win32.Generic!BT)

It's a serious problem since OOo ver 3.2 can not run after the files has been quarantined!

Kind regards
perlonn

These are most likely false positives. Did you download from http://www.openoffice.org?

Edit:
see http://user.services.openoffice.org/en/ ... an#p126527

If your package does not come from http://openoffice.org it may contain anything. Verify your copy of the package against the official md5 list in order to be sure that you got the right thing byte by byte.
http://www.openoffice.org/dev_docs/using_md5sums.html
http://download.openoffice.org/md5sums/ ... d5sums.txt

Same issue happening for me. I'm running:
Vipre antivirus software on Windows 7 Professional OS, with OpenOffice 3.2.0.

Getting "trojan" reports for files:
salhelper3MSC.dll
helplinkermi.dll

I had downloaded OpenOffice yesterday after clean Windows 7 installation earlier in day (not an upgrade), and am now my AV had "blocked" the 2 files above, and I cannot open OpenOffice.

Any suggestions appreciated. Thanks!

wmccann wrote:Any suggestions appreciated. Thanks!

Everything has been said. You don't even tell us where you downloaded the package from. If it came from http://openoffice.org it is unlikely that it ships with malware in it. The md5 test proves if your download is the right one actually.

It is often recommended to download, do the md5 test, cut the internet connection, shut down any virus scanner, install, start virus and connection.
I use to recommend Linux.

Hi
I have the same problem, my download is from Openoffice.org it is the danish version and the MD5 is checked and OK, my virus program is Lavasoft installed 2 days ago before i was running Bullguard and 3.2 was running without problems.
Please advice.
RGDS. Alfred

Well, then it is a matter of trust. Do you trust the OOo web-site or your virus scanner? In the latter case you should definitvely not install OpenOffice.org because someone must have hacked the site, pushed his version of the package onto the server together with matching md5 sums.

You need to read this http://supportforums.sunbeltsoftware.co ... nkermi.dll.

Note that this false positive is limited to some security applications only. On my W2k system with a corporate security pack (base on Symantec software IIRC) I've installed it without any problem.

Remember that anti-virus work by checking the signature of files. If one has by coincidence the same one, then it gets flagged. But it doesn't mean it is a bad one.

No problems either with the Home version of AVG 9.0, and the corporate version of AVG 9.0.

Hi!
I can not from the observations which I have read the above, see that I can exclude that the Danish version 3.2 of OOo can be virus-affected with a trojan. I can say that the installation file has been downloaded from OpenOffice.org.

After OOo ver 3.2 (Danish version) has been re-install - comes Ad-Aware Pro ver 8.2.0 in nature and puts the file salhelper3MSC.dll in the path C: \ Program Files \ OpenOffice.org 3 \ URE \ bin \ salhelper3MSC.dll quarantined. Then work OOo ver 3.2 not at all, which is shown by an error message telling you that the file salhelper3MSC.dll missing. Although the file is moved back from the quarantine area will OOo ver 3.2 still does not work.

I can immediately see that it apparently is a Danish problem - ie OOo ver 3.2 Danish version, but on the other hand, this does not mean that the OS files are not also infected with a virus because I have some follow-alarms instantly after that I tried to open OOo ver 3.2, on files that do not belong to OOo package, but which has serious implications for the use of the software package.

Hope that soon found a workable solution, because I so can not do without my wordprocessors!

Kind regards
perlonn

I encountered the exact same problem and the technical support from Viper (Sunbelt software) confirmed that it is a "false positive" basically a file that is not recognized by the virus scan software and thus it is interpreted as a potential threat to your system, yet they know for a fact that the .dll files from OpenOffice.org are not a threat and they are working on updating the virus software so they will be recognized, and the problem will be resolved in future software updates. In the meantime, he suggested to "restore from quarantine" and include in the "always allow" list, so that the program can run normally. I hope this helps!

I should be more patient when I post for help but unfortunately I let my frustration get the best of me. I waited for a while and realized I was posting when very few are online so I got busy trying a number of things to try to rectify this on my own. I had first downloaded the full version (latest, at the time) and experienced the problem, I uninstalled and found a smaller version of OO and installed that and it worked satisfactorily for a few days and then a virus was detected again. So, I went back and did a clean install of the full version once again and have had not problems with it since. The first install was downloaded from OpenOffice.org the second and third downloads were from CNET (who guarantees is clean). I was suspicious that it was a false positive but didn't want to take a chance with that. At any rate VIPRE must have corrected their program in the interim. I thank you all for you posts and your support. You nerds are awesome!!!