[Solved] Trojan detected in file salhelper3MSC.dll

Discuss setup / installation issues - Add a spell checker, Language pack?

[Solved] Trojan detected in file salhelper3MSC.dll

Postby icsaidme » Sun Feb 21, 2010 1:47 pm

Hi,
I hope someone can help me. My AV detected a trojan with the salhelper3MSC.dll file and quarantined it so now I can't open or start "Open Office" I think there was more than just this one file infected but it is the only one I was able to write down. The name of the supposed virus is Trojan.Win32.Generic!BT and is deemed "High Risk. I downloaded Version 3.2 on Feb 1, and my AV program detected a problem just yesterday. Is this truly a virus? If so, is there a clean version some where?
Thank you!
Last edited by Hagar Delest on Fri Mar 12, 2010 12:36 am, edited 1 time in total.
Reason: tagged [Solved].
OOo 2.3.X on Ms Windows XP
icsaidme
 
Posts: 2
Joined: Sat Aug 30, 2008 6:30 am

Re: Trojan detected in file salhelper3MSC.dll

Postby perlonn » Sun Feb 21, 2010 3:30 pm

Ad-Aware Pro ver 8.2.0 (Lavasoft) detecked trojan horses (Trojan.Win32.Generic!BT) in C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll

also deteckted:
helplinkermi.dll (Trojan.Win32.Generic!BT (10112520)) - C:\Program Files\OpenOffice.org 3\program\helplinkermi.dll (Trojan.Win32.Generic!BT)
unordfmi.dll (Trojan.Win32.Generic!BT (39878664)) - C:\Program Files\OpenOffice.org 3\program\unordfmi.dll (Trojan.Win32.Generic!BT)
and
salhelper3MSC.dll (Trojan.Win32.Generic!BT (10112720)) - C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll (Trojan.Win32.Generic!BT)

It's a serious problem since OOo ver 3.2 can not run after the files has been quarantined!

Kind regards
perlonn
OOo 3.2 (da), Windows Vista Business SP 2 (da)
perlonn
 
Posts: 2
Joined: Sun Feb 21, 2010 3:11 pm

Re: Trojan detected in file salhelper3MSC.dll

Postby thomasjk » Sun Feb 21, 2010 4:58 pm

These are most likely false positives. Did you download from http://www.openoffice.org?
Tom K.
Windows 10 Home version 1703 15063.540
LibreOffice 5.3.6
thomasjk
Volunteer
 
Posts: 4325
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Trojan detected in file salhelper3MSC.dll

Postby Villeroy » Sun Feb 21, 2010 5:18 pm

If your package does not come from http://openoffice.org it may contain anything. Verify your copy of the package against the official md5 list in order to be sure that you got the right thing byte by byte.
http://www.openoffice.org/dev_docs/using_md5sums.html
http://download.openoffice.org/md5sums/ ... d5sums.txt
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 16.04, OpenOffice 4.x & LibreOffice 5.x
User avatar
Villeroy
Volunteer
 
Posts: 24656
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Trojan detected in file salhelper3MSC.dll

Postby wmccann » Sun Feb 21, 2010 8:47 pm

Same issue happening for me. I'm running:
Vipre antivirus software on Windows 7 Professional OS, with OpenOffice 3.2.0.

Getting "trojan" reports for files:
salhelper3MSC.dll
helplinkermi.dll

I had downloaded OpenOffice yesterday after clean Windows 7 installation earlier in day (not an upgrade), and am now my AV had "blocked" the 2 files above, and I cannot open OpenOffice.

Any suggestions appreciated. Thanks!
OpenOffice 3.2 on Windows 7
wmccann
 
Posts: 1
Joined: Sun Feb 21, 2010 8:43 pm

Re: Trojan detected in file salhelper3MSC.dll

Postby Villeroy » Sun Feb 21, 2010 8:57 pm

wmccann wrote:Any suggestions appreciated. Thanks!

Everything has been said. You don't even tell us where you downloaded the package from. If it came from http://openoffice.org it is unlikely that it ships with malware in it. The md5 test proves if your download is the right one actually.

It is often recommended to download, do the md5 test, cut the internet connection, shut down any virus scanner, install, start virus and connection.
I use to recommend Linux.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 16.04, OpenOffice 4.x & LibreOffice 5.x
User avatar
Villeroy
Volunteer
 
Posts: 24656
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Trojan detected in file salhelper3MSC.dll

Postby alfredl » Sun Feb 21, 2010 11:26 pm

Hi
I have the same problem, my download is from Openoffice.org it is the danish version and the MD5 is checked and OK, my virus program is Lavasoft installed 2 days ago before i was running Bullguard and 3.2 was running without problems.
Please advice.
RGDS. Alfred
OpenOffice 3.2.0 DA on Windows Vista
alfredl
 
Posts: 1
Joined: Sun Feb 21, 2010 11:19 pm

Re: Trojan detected in file salhelper3MSC.dll

Postby Villeroy » Sun Feb 21, 2010 11:46 pm

Well, then it is a matter of trust. Do you trust the OOo web-site or your virus scanner? In the latter case you should definitvely not install OpenOffice.org because someone must have hacked the site, pushed his version of the package onto the server together with matching md5 sums.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 16.04, OpenOffice 4.x & LibreOffice 5.x
User avatar
Villeroy
Volunteer
 
Posts: 24656
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Trojan detected in file salhelper3MSC.dll

Postby thomasjk » Sun Feb 21, 2010 11:50 pm

Tom K.
Windows 10 Home version 1703 15063.540
LibreOffice 5.3.6
thomasjk
Volunteer
 
Posts: 4325
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Trojan detected in file salhelper3MSC.dll

Postby Hagar Delest » Sun Feb 21, 2010 11:52 pm

Note that this false positive is limited to some security applications only. On my W2k system with a corporate security pack (base on Symantec software IIRC) I've installed it without any problem.

Remember that anti-virus work by checking the signature of files. If one has by coincidence the same one, then it gets flagged. But it doesn't mean it is a bad one.
AOO 4.1.4 on Xubuntu 17.10, (Artful Aardvark) and 4.1.3 on Windows 7 (with winPenPack port).
User avatar
Hagar Delest
Moderator
 
Posts: 27661
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Trojan detected in file salhelper3MSC.dll

Postby TheGurkha » Sun Feb 21, 2010 11:53 pm

No problems either with the Home version of AVG 9.0, and the corporate version of AVG 9.0.
Ubuntu 14.10 Utopic Unicorn, LibreOffice Version: 4.3.3.2
Gurkha Welfare Trust
User avatar
TheGurkha
Volunteer
 
Posts: 6482
Joined: Thu Mar 13, 2008 12:13 pm
Location: North Wales, UK.

Re: Trojan detected in file salhelper3MSC.dll

Postby perlonn » Tue Feb 23, 2010 12:50 am

Hi!
I can not from the observations which I have read the above, see that I can exclude that the Danish version 3.2 of OOo can be virus-affected with a trojan. I can say that the installation file has been downloaded from OpenOffice.org.

After OOo ver 3.2 (Danish version) has been re-install - comes Ad-Aware Pro ver 8.2.0 in nature and puts the file salhelper3MSC.dll in the path C: \ Program Files \ OpenOffice.org 3 \ URE \ bin \ salhelper3MSC.dll quarantined. Then work OOo ver 3.2 not at all, which is shown by an error message telling you that the file salhelper3MSC.dll missing. Although the file is moved back from the quarantine area will OOo ver 3.2 still does not work.

I can immediately see that it apparently is a Danish problem - ie OOo ver 3.2 Danish version, but on the other hand, this does not mean that the OS files are not also infected with a virus because I have some follow-alarms instantly after that I tried to open OOo ver 3.2, on files that do not belong to OOo package, but which has serious implications for the use of the software package.

Hope that soon found a workable solution, because I so can not do without my wordprocessors!

Kind regards
perlonn
Last edited by perlonn on Tue Feb 23, 2010 2:48 pm, edited 1 time in total.
OOo 3.2 (da), Windows Vista Business SP 2 (da)
perlonn
 
Posts: 2
Joined: Sun Feb 21, 2010 3:11 pm

Re: Trojan detected in file salhelper3MSC.dll

Postby nildam » Tue Feb 23, 2010 2:59 am

I encountered the exact same problem and the technical support from Viper (Sunbelt software) confirmed that it is a "false positive" basically a file that is not recognized by the virus scan software and thus it is interpreted as a potential threat to your system, yet they know for a fact that the .dll files from OpenOffice.org are not a threat and they are working on updating the virus software so they will be recognized, and the problem will be resolved in future software updates. In the meantime, he suggested to "restore from quarantine" and include in the "always allow" list, so that the program can run normally. I hope this helps!
OpenOffice.org 3.2
Windos Vista 64-bit
nildam
 
Posts: 1
Joined: Tue Feb 23, 2010 2:46 am

Re: Trojan detected in file salhelper3MSC.dll

Postby icsaidme » Fri Mar 12, 2010 12:09 am

I should be more patient when I post for help but unfortunately I let my frustration get the best of me. I waited for a while and realized I was posting when very few are online so I got busy trying a number of things to try to rectify this on my own. I had first downloaded the full version (latest, at the time) and experienced the problem, I uninstalled and found a smaller version of OO and installed that and it worked satisfactorily for a few days and then a virus was detected again. So, I went back and did a clean install of the full version once again and have had not problems with it since. The first install was downloaded from OpenOffice.org the second and third downloads were from CNET (who guarantees is clean). I was suspicious that it was a false positive but didn't want to take a chance with that. At any rate VIPRE must have corrected their program in the interim. I thank you all for you posts and your support. You nerds are awesome!!! :bravo:
icsaidme
 
Posts: 2
Joined: Sat Aug 30, 2008 6:30 am


Return to Install, Setup and Troubleshooting

Who is online

Users browsing this forum: LilZebra and 6 guests