Behavior shield question internat.exe

Avast Free Antivirus / Premium Security
1

hallo,

I just starter my PC and Avast pops up this behavior question (see screenshot).
Target object cannot be seen on the popup, so here the whole path HKEY_USERS\S-1-5-21-2678822560-3673682103-668471605-1000\Software\Microsoft\Windows\CurrentVersion\Run\internat.exe.

It is strange that under this registry key I can not find internat.exe in the registry??? Internat.exe is suspisious file name :frowning: And the name of the targer starts registry\user but I can find only HKEY_User??? Or is this something else???
And the ubpm.dll dosent say me anything???

can someone help me
I use Win7 Home 64bit

2

internat.exe is a Microsoft Input Locales.
Looks like you have BS setuped to ask. Please change it to Auto-decide.
(avast! gui > resident shields > behavior shield > advanced settings > Ask change to auto-decide)

Use option ā€œallow and add to trusted programsā€
Thanks

3

Guckst du hier.

Set behaviour shield to ā€œautomatischā€

4

And just for info: Klick!

5

I know how to set BS to auto.
On this page http://www.neuber.com/taskmanager/deutsch/prozess/internat.exe.html in the text at the beginnng it is written that this service doesnt run unter Win7 and Vista, and if so - than it is a virus or trojan ???

and where to find thr key Regestery\user? is it the same as HKEY_USER?

6

Send the file to VirusTotal. http://www.virustotal.com/
Post the results here.

7

Okay, I read Neubert.

Then block it. Search for internat.exe on your harddrive and have it scanned at virustotal.com.

Run a malwarebytes antimalware scan and post the log here.

8

i can not find internat.exe on my harddrive ??? no such file

9

WƤre gut, wenn du eine Signatur angibst, dann kƶnnen wir dir besser helfen. :wink:
Danke,
asyn

10

what do you mean with Signatur (ich bin Deutscher, aber das ist ein englischsprachiges Forum :slight_smile:

11

Signatur ist deutsch;
signature would be the English term. :wink:

12

We do need some more informationā€¦ as far as I see, it is unsuspicious.
Some program wants the ā€œinternat.exeā€ to be added to the autostart. Since there is no such program, nothing will happen. (If you searched your HD thoroughly and have explorer enabled to view system files and hidden files)

Did you install anything prior to the last boot?
When did this happen: first boot after installation of Avast?
Or did it happen all of a sudden without you changing anything knowingly to Avast / Windows / Installations?

Anyway, I would block it and run Malwarebytes Antimalware.

13

Malwarebytes is running, so far 2 funds found. When it ends I will post back.

Did you install anything prior to the last boot?
no
When did this happen: first boot after installation of Avast? Or did it happen all of a sudden without you changing anything knowingly to Avast / Windows / Installations?
I use Avast for many years. Today at the morning there was no such popup. Nothing was installed or changed. Now I start PC and Avast pops it up. Maybe does this have something to do with some windows tasks...some days ago I upgraded to v9 and turned Behavior Shield ON, till than it was off.
14

Malwarebytes finds thingsā€¦ not too good a sign, I fear. Letā€™s wait and see.

15

Malwareb still runnungā€¦
If I choose Deny and move to chest, which file will be moved and where is the chest?

16

???
Let Mbam finish its scan.

17

We are talking about Behaviour Shield, right?
There is no ā€œmove to chestā€.
ā€œDenyā€ just cancels the requested program action.

18

+1

19
We are talking about Behaviour Shield, right? There is no "move to chest".

well and what is this (screenshot)

20

ā€¦ooops.

Sorry. Is there also a ā€œBlockā€ only?
Havenā€™t seen the BS pop up, so I looked up the predefined actions, and there is no ā€œmove to chestā€ā€¦

It would be ubpm.dll - that should not be moved IMHO.