[Solved] Trojan detected in file salhelper3MSC.dll

Discuss setup / installation issues - Add a spell checker, Language pack?
Post Reply
icsaidme
Posts: 2
Joined: Sat Aug 30, 2008 6:30 am

[Solved] Trojan detected in file salhelper3MSC.dll

Post by icsaidme »

Hi,
I hope someone can help me. My AV detected a trojan with the salhelper3MSC.dll file and quarantined it so now I can't open or start "Open Office" I think there was more than just this one file infected but it is the only one I was able to write down. The name of the supposed virus is Trojan.Win32.Generic!BT and is deemed "High Risk. I downloaded Version 3.2 on Feb 1, and my AV program detected a problem just yesterday. Is this truly a virus? If so, is there a clean version some where?
Thank you!
Last edited by Hagar Delest on Fri Mar 12, 2010 12:36 am, edited 1 time in total.
Reason: tagged [Solved].
OOo 2.3.X on Ms Windows XP
perlonn
Posts: 2
Joined: Sun Feb 21, 2010 3:11 pm

Re: Trojan detected in file salhelper3MSC.dll

Post by perlonn »

Ad-Aware Pro ver 8.2.0 (Lavasoft) detecked trojan horses (Trojan.Win32.Generic!BT) in C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll

also deteckted:
helplinkermi.dll (Trojan.Win32.Generic!BT (10112520)) - C:\Program Files\OpenOffice.org 3\program\helplinkermi.dll (Trojan.Win32.Generic!BT)
unordfmi.dll (Trojan.Win32.Generic!BT (39878664)) - C:\Program Files\OpenOffice.org 3\program\unordfmi.dll (Trojan.Win32.Generic!BT)
and
salhelper3MSC.dll (Trojan.Win32.Generic!BT (10112720)) - C:\Program Files\OpenOffice.org 3\URE\bin\salhelper3MSC.dll (Trojan.Win32.Generic!BT)

It's a serious problem since OOo ver 3.2 can not run after the files has been quarantined!

Kind regards
perlonn
OOo 3.2 (da), Windows Vista Business SP 2 (da)
thomasjk
Volunteer
Posts: 4451
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Trojan detected in file salhelper3MSC.dll

Post by thomasjk »

These are most likely false positives. Did you download from http://www.openoffice.org?
Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
User avatar
Villeroy
Volunteer
Posts: 31269
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Trojan detected in file salhelper3MSC.dll

Post by Villeroy »

If your package does not come from http://openoffice.org it may contain anything. Verify your copy of the package against the official md5 list in order to be sure that you got the right thing byte by byte.
http://www.openoffice.org/dev_docs/using_md5sums.html
http://download.openoffice.org/md5sums/ ... d5sums.txt
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 18.04 with LibreOffice 6.0, latest OpenOffice and LibreOffice
wmccann
Posts: 1
Joined: Sun Feb 21, 2010 8:43 pm

Re: Trojan detected in file salhelper3MSC.dll

Post by wmccann »

Same issue happening for me. I'm running:
Vipre antivirus software on Windows 7 Professional OS, with OpenOffice 3.2.0.

Getting "trojan" reports for files:
salhelper3MSC.dll
helplinkermi.dll

I had downloaded OpenOffice yesterday after clean Windows 7 installation earlier in day (not an upgrade), and am now my AV had "blocked" the 2 files above, and I cannot open OpenOffice.

Any suggestions appreciated. Thanks!
OpenOffice 3.2 on Windows 7
User avatar
Villeroy
Volunteer
Posts: 31269
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Trojan detected in file salhelper3MSC.dll

Post by Villeroy »

wmccann wrote:Any suggestions appreciated. Thanks!
Everything has been said. You don't even tell us where you downloaded the package from. If it came from http://openoffice.org it is unlikely that it ships with malware in it. The md5 test proves if your download is the right one actually.

It is often recommended to download, do the md5 test, cut the internet connection, shut down any virus scanner, install, start virus and connection.
I use to recommend Linux.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 18.04 with LibreOffice 6.0, latest OpenOffice and LibreOffice
alfredl
Posts: 1
Joined: Sun Feb 21, 2010 11:19 pm

Re: Trojan detected in file salhelper3MSC.dll

Post by alfredl »

Hi
I have the same problem, my download is from Openoffice.org it is the danish version and the MD5 is checked and OK, my virus program is Lavasoft installed 2 days ago before i was running Bullguard and 3.2 was running without problems.
Please advice.
RGDS. Alfred
OpenOffice 3.2.0 DA on Windows Vista
User avatar
Villeroy
Volunteer
Posts: 31269
Joined: Mon Oct 08, 2007 1:35 am
Location: Germany

Re: Trojan detected in file salhelper3MSC.dll

Post by Villeroy »

Well, then it is a matter of trust. Do you trust the OOo web-site or your virus scanner? In the latter case you should definitvely not install OpenOffice.org because someone must have hacked the site, pushed his version of the package onto the server together with matching md5 sums.
Please, edit this topic's initial post and add "[Solved]" to the subject line if your problem has been solved.
Ubuntu 18.04 with LibreOffice 6.0, latest OpenOffice and LibreOffice
thomasjk
Volunteer
Posts: 4451
Joined: Tue Dec 25, 2007 4:52 pm
Location: North Carolina

Re: Trojan detected in file salhelper3MSC.dll

Post by thomasjk »

Tom K.
Windows 10 Home version 1803 17134.165
LibreOffice 5.4.7.2
User avatar
Hagar Delest
Moderator
Posts: 32627
Joined: Sun Oct 07, 2007 9:07 pm
Location: France

Re: Trojan detected in file salhelper3MSC.dll

Post by Hagar Delest »

Note that this false positive is limited to some security applications only. On my W2k system with a corporate security pack (base on Symantec software IIRC) I've installed it without any problem.

Remember that anti-virus work by checking the signature of files. If one has by coincidence the same one, then it gets flagged. But it doesn't mean it is a bad one.
LibreOffice 7.6.2.1 on Xubuntu 23.10 and 7.6.4.1 portable on Windows 10
User avatar
TheGurkha
Volunteer
Posts: 6482
Joined: Thu Mar 13, 2008 12:13 pm
Location: North Wales, UK.

Re: Trojan detected in file salhelper3MSC.dll

Post by TheGurkha »

No problems either with the Home version of AVG 9.0, and the corporate version of AVG 9.0.
Ubuntu 14.10 Utopic Unicorn, LibreOffice Version: 4.3.3.2
Gurkha Welfare Trust
perlonn
Posts: 2
Joined: Sun Feb 21, 2010 3:11 pm

Re: Trojan detected in file salhelper3MSC.dll

Post by perlonn »

Hi!
I can not from the observations which I have read the above, see that I can exclude that the Danish version 3.2 of OOo can be virus-affected with a trojan. I can say that the installation file has been downloaded from OpenOffice.org.

After OOo ver 3.2 (Danish version) has been re-install - comes Ad-Aware Pro ver 8.2.0 in nature and puts the file salhelper3MSC.dll in the path C: \ Program Files \ OpenOffice.org 3 \ URE \ bin \ salhelper3MSC.dll quarantined. Then work OOo ver 3.2 not at all, which is shown by an error message telling you that the file salhelper3MSC.dll missing. Although the file is moved back from the quarantine area will OOo ver 3.2 still does not work.

I can immediately see that it apparently is a Danish problem - ie OOo ver 3.2 Danish version, but on the other hand, this does not mean that the OS files are not also infected with a virus because I have some follow-alarms instantly after that I tried to open OOo ver 3.2, on files that do not belong to OOo package, but which has serious implications for the use of the software package.

Hope that soon found a workable solution, because I so can not do without my wordprocessors!

Kind regards
perlonn
Last edited by perlonn on Tue Feb 23, 2010 2:48 pm, edited 1 time in total.
OOo 3.2 (da), Windows Vista Business SP 2 (da)
nildam
Posts: 1
Joined: Tue Feb 23, 2010 2:46 am

Re: Trojan detected in file salhelper3MSC.dll

Post by nildam »

I encountered the exact same problem and the technical support from Viper (Sunbelt software) confirmed that it is a "false positive" basically a file that is not recognized by the virus scan software and thus it is interpreted as a potential threat to your system, yet they know for a fact that the .dll files from OpenOffice.org are not a threat and they are working on updating the virus software so they will be recognized, and the problem will be resolved in future software updates. In the meantime, he suggested to "restore from quarantine" and include in the "always allow" list, so that the program can run normally. I hope this helps!
OpenOffice.org 3.2
Windos Vista 64-bit
icsaidme
Posts: 2
Joined: Sat Aug 30, 2008 6:30 am

Re: Trojan detected in file salhelper3MSC.dll

Post by icsaidme »

I should be more patient when I post for help but unfortunately I let my frustration get the best of me. I waited for a while and realized I was posting when very few are online so I got busy trying a number of things to try to rectify this on my own. I had first downloaded the full version (latest, at the time) and experienced the problem, I uninstalled and found a smaller version of OO and installed that and it worked satisfactorily for a few days and then a virus was detected again. So, I went back and did a clean install of the full version once again and have had not problems with it since. The first install was downloaded from OpenOffice.org the second and third downloads were from CNET (who guarantees is clean). I was suspicious that it was a false positive but didn't want to take a chance with that. At any rate VIPRE must have corrected their program in the interim. I thank you all for you posts and your support. You nerds are awesome!!! :bravo:
Post Reply