Every time I start Win:Small-gen2-trj-Solved

system · 2006-10-28T09:00:15.000Z

Hello everyone,
I had a problem up until 5 minutes ago.

"Every time I restart the pc just before it finishes loading every program when starting up, I get this message about E:\DOCUMENTS AND SETTINGS\Jim\LOCAL SETTINGS\Temp\tmp1.tmp being infected with the Win32:small-gen2[trj].

Ok, I move it to the chest and every time I restart the same thing.
I also ran a scan before Windows boots and it finds nothing.

I see in the history that this starts in the 24th of October when in fact while sufring the net I was warned by Avast that a trojan tried to hit.But, it was supposed to stop it."

I found what to do.I went to msconfig and saw that the last program to run from the startup programs is an ms_update_069_7723.exe.Guess when it came onboard…
It seems this exe is the reason.I hope it help some people.

Go to the startup directory and you will find a 24kb file which is the root of the problem.I deleted it and made the msconfig not run it and all is ok.

Lisandro · 2006-10-28T11:42:57.000Z

DimitrisK post:1:

I deleted it and made the msconfig not run it and all is ok.

What did you delete? The file ms_update_069_7723.exe or the msconfig entry?
Take a full scan of trojan removers: a-squared, Free AVG Antispyware, SUPERantispyware or Spyware Terminator.

DavidR · 2006-10-28T13:07:38.000Z

I think that DimitrisK deleted the file and removed/unchecked the entry from the startup tab in msconfig the operative word being ‘and’.

DimitrisK did you send a sample of the ms_update_069_7723.exe file to avast so they could analyse it and include it in the signatures ?

system · 2006-10-28T15:33:12.000Z

It’s like DavidR says.I deleted the file AND unchecked the msfconfig entry.

I 'm glad I didn’t remove it from the recycle bin, if it’s useful for analysis.I 'd like to send it to Avast but how?

Lisandro · 2006-10-28T15:50:12.000Z

DimitrisK post:4:

I 'd like to send it to Avast but how?

Send an email with the file (false positive or infected) to: virus@avast.com
You can zip and password the files… Inform a link to this thread and the password used.
You can send the files to Chest and, from there, resend to Alwil for analysis.
Thanks.

DavidR · 2006-10-28T16:55:51.000Z

DimitrisK, good news that you didn’t remove it completely as the sample when you send it to avast will help others.

If you want to keep things for analysis purposes, open the virus chest, User Files, Add, and navigate to the infected file and add it to the chest where it can’t do any harm. Here as Tech said you can send it the Alwil Software and scan the file in the future to check if it is now detected.

system · 2006-10-28T21:41:27.000Z

All right, chest says it is sent to Alwil.I 'm really looking forward to hearing from them in case it was something helpful.

In fact,I have read a lot of messages in pc forums about having problems nobody could help with and the file is always there when they post a hijackthis log!

DavidR · 2006-10-28T22:47:52.000Z

You will normally only be contacted if they require any further information.

system · 2006-10-29T07:49:57.000Z

Oh!OK then! ;D

system · 2006-11-05T13:19:17.000Z

Yes it is definitely the file responsible! I went to delete it and I accidently ran it and it did the routine that it does at start up. I hope this is what was also what was causing my computer to have 60 second shutdown countdown.

system · 2007-02-01T02:36:40.000Z

I have some bad news.
I had the same message about Win32:Small-gen2…
I looked in msconfig and also did a search for the file called
ms_update_069_7723.exe
and found no trace of it whatsoever on my machine.
Anyone have any other ideas?

Thanks.

system · 2007-02-01T02:46:22.000Z

Hi LaDulcinea,

What is the name of the infected file and path, and what is your operating system?

system · 2007-02-04T10:56:56.000Z

Thanks!!! ;D I had the same problem for two or three weeks and was unable to solve it. The only difference was that in my case the application was called “ms_update_0612_kb74062.exe”, otherwise all was the same. Actually you don’t need to uncheck the msconfig entry since after you delete the .exe file it disappears automatically. Once again, thanks a lot!

Announcements