Yesterday I downloaded and successfully installed a new version of Tradestation software and used it all day fine. This morning when I opened it I got a message from Avast that the file “whserver.exe” in that program contained the above virus. I could not repair it. (I use the free version of Avast and the menu item “disable VRDB is permanently checked”).
I’ve tried everything I’ve read here to get rid of it…I uninstalled the Tradestation program entirely, rebooted in SAFE mode, ran Avast thorough scan, AdAware and Spybot. I even downloaded the program again (that firm said they’ve had no other complaints of a virus today, and I did use it without incident yesterday) and have attempted several reinstallations. Each time Avast reports this virus in the same file but scanning with all of the above doesn’t find it. I’ve also run the hjt software and have a log if that would help.
I desparately need some advice from the experts here. Thanks.
Eddy’s HiJackThis Info and Analysis Then visit Eddy’s HiJackThis pages, HijackThis log file analyzer and follow the directions there and get back to us if you need more help…
User’s FAQ A visit to the thread will give you a lot of useful advice and an idea of the information needed to Help you fully.
I just came home from the office, attempted to log onto Tradestation on my home computer and got the very same virus message from Avast. This machine hasn’t been used since yesterday, like the one at my office. I noticed that both machines downloaded new databases today. The Tradestation program will not operate now on either computer. IF this is a false positive then it has to be cleared up and I’m stuck at the moment as to how to do that.
Send the file(s) in a password protected zip to virus@avast.com Mention in the email that you think it is a false positive and why you think it is. Don’t forget to put the password also in the mail
This way Alwil’s lab can correct it for a future vps version.
Dang, I was just about to scan my system to see if it gave false positives here also. But Alwil was fast again so now I have the corrected vps already before I could start scanning ;D ;D ;D ROFL