avast keeps finding trojan

system · 2006-09-05T21:53:20.000Z

Hi. I keep getting messages from Avast that Sign of the following Trojan has been found:

Win32:Horst-AF [trj]

All signs seem to show up in :

Docume/Owner/locals/TEMP

they always show up as:

exssd32.3.exe

with a different number before “ex” like 41 55 74 15, etc. so for example:

45exssd32.3.exe

No matter how many times I put in the chest and delete, it doesn’t matter. It keeps coming back over and over.

I tried running another scanner (Ewido) but this scanner doesn’t even detect the Trojan as existing.

I also tried doing a system restore to a previous date before messages about the trojan began, but my attempts have all resulted in the message: “System restore did not succeed” – so I’m guessing the virus has messed up my system restore function as well.

Anybody know how I can get rid of this thing?

Thanks!

Lisandro · 2006-09-05T22:07:16.000Z

velivolus post:1:

No matter how many times I put in the chest and delete, it doesn’t matter. It keeps coming back over and over.
I tried running another scanner (Ewido) but this scanner doesn’t even detect the Trojan as existing.

If a virus is replicant (coming and coming again), you should:

Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405
Clean your temporary files.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot.
Besides ewido, try a-squared or Spyware Terminator (trojan removers).

Other option is scanning in SafeMode (repeatedly press F8 while booting): http://support.microsoft.com/default.aspx?scid=kb;en-us;315222

system · 2006-09-05T23:07:09.000Z

Thanks a lot for your help!
I just did this, and so far at least since reboot Avast has not given notice of the sign of any Trojan.

I watched as Avast did the boot-scan and it seemed to find even more Trojans than I realized I had. Several variations of Horst (L, G, etc.) something called SPABOT - G, and also Win 32 Banker…

Anyway, looks like they are all gone now (fingers crossed).

Thanks again for your help.

Am I able to renable System Restore at this point?

Lisandro · 2006-09-06T01:24:24.000Z

velivolus post:3:

Am I able to renable System Restore at this point?

If you’re clean, you could enable it again
Welcome to avast forums 8)

By the way, there aren’t that much antivirus that offer the boot time scanning

system · 2006-09-07T12:35:37.000Z

hello and sry for my comin german-english

i have the same problem and the trojans has antivir detected. i searched forums with people who have the same problem.
ive done all what Tech says. First disabled system restore on XP, cleaned up my temp files, then boot in safe mode and no trojans where found. then i boot up again and the trojans begin to create self again. ive downloaded the avast software and searched for viruses and trojans at bootup. no trojans where found. ive booted up normal and after 15 seconds a new trojan was found by antivir.

any suggestions what i can do now?

edit: avast even DONT detect that the .exe files are trojans. i have the newest update of avast.

exmodul32c.exe
exssd32.exe
exhdd.exe

with modified/random numbers before and after the filename

DavidR · 2006-09-07T13:58:04.000Z

A forum search for exmodul finds many hits:
http://forum.avast.com/index.php?topic=20027.0
http://forum.avast.com/index.php?topic=19474.0
These may help in cleaning the infection.

If you can send the suspect files to avast.
If you are not getting a virus warning that you believe is a new, undetected virus then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a either a new, undetected virus and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

Announcements