Also seeing lansetm.exe

Viruses and worms
1

Hi Pondus,

I posted in Jao’s topic because it was the same question regarding the same virus. But I’ll follow up here.

All the programs and drivers were carefully downloaded directly from the manufacturer’s websites: www.microsoft.com, www.mozilla.com, www.ecs.com.tw, www.airlink101.com, and www.avast.com. The XP install disk is over 5 years old.

I’ve still got all the original zip files sitting on this system. I’ll trying running a thorough scan. I’d guess that if the virus did come from inside one of these zip files, Avast would be able to detect it.

2

you can upload the files to virustotal www.virustotal.com when you have the result copy the URL in the addressbar and post it here

and if Polonus is correct (he always is) you may have the virtumonde virus, and probably need the help from essexboy to get it out

Check your computer for Malware with

MBAM http://filehippo.com/download_malwarebytes_anti_malware/
update and run quick scan, click the button “remove selected” to quarantine anything found, and restart

SAS http://filehippo.com/download_superantispyware/

Are cookies really spyware and are they dangerous?
http://www.superantispyware.com/supportfaqdisplay.html?faq=26

come back and tell us if it worked

If anything is found other than cookies you may post the scan logs here

3

Information about … lansetm.exe … at the link below :

http://www.browserdefender.com/file/480724/site/01net.com/ (see #13 on the list)
This could be related to Realtek Lan and it is possible that this is a legitimate file if the MD5 is the same as #13 on the list.

4

Thanks for the info CharleyO. My computer uses a Realtek RT8111 Gigabit Ethernet NIC, and the lansetm.exe file is part of that driver package. I downloaded the driver package from:

http://www.ecsusa.com/ECSWebSite/Downloads/DownloadFile.aspx?catid=1&driverid=3185&areaid=2&LanID=9

ECS is the manufacturer of my motherboard, an NFORCE6M-A V2.0

The MD5 is different. My lansetm.exe file is only 56320 bytes, but it comes from a different driver package.

Here’s the virustotal analysis:

http://www.virustotal.com/analisis/16a22f844319328e3bc593378a080063b30bf9fe6ed7a2ebc3acb5f32f744beb-1263927080

2/39 identified the file as a virus. Only Avast and GData labeled the file as a virus.

After today’s Avast db update, I reinstalled the lansetm.exe file into the C:\Windows\Options\Cabs directory, and ran a thorough scan of the directory. It no longer flags this file as a virus.

It was a false positive.

5

Glad to know all is better, Frobozz. :slight_smile:

Please come back often and learn more.