msiexec.exe Trojan on June 19th?

Viruses and worms
1

About three days ago, there was a system message asking me to allow msiexec.exe to run. Everytime I tried to terminate it, it kept on popping up. I ended up googling what it was and it said it was a safe installer used by windows so I clicked allow. Now, yesterday there was another installer asking for my permission to run called setup3601133824.exe. I terminated it through task manager, then I found its file location which was under computer/user. I deleted it. Then I realized that msiexec.exe file was there too. I clicked on properties and on information it said Internet client and publisher is casper. I clicked on deny all of its access and then I deleted it and ran an avast scan. Nothing strange has happened yet. Avast did find other 12 infected files it included glu3232.exe.

I checked online and there are several reports of similar happenings to other people around the same day. June 19th.

I know that mcafee has listed it as a trojan and has 31 reports so far. But has avast found a way to get rid of this trojan? Has it been listed? where can I find information about it? Have any of you had similar experiences? Please help. I don’t want to have to restore my pc to factory default.

2

upload suspicious file(s) to www.virustotal.com and test with 43 malware scanners
when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti http://virusscan.jotti.org/en
VirSCAN http://virscan.org/

Check for malware with this

Malwarebytes Anti-Malware 1.51. http://filehippo.com/download_malwarebytes_anti_malware/
always update so you have the latest signatures before you scan
click on the remove selected button to quarantine anything found

post the scan log here

3

I actually ended up deleting the file. It didn’t come back, but what worries me is that I clicked run. Nothing strange happened, except that two more .exe files showed up under my user folder. I ran avast and it found those to be trjs. It cleaned those up, but I don’t know how safe my computer is now, since I clicked run on that msiexec.exe. What should I do?

4

Well, then, just apply this part

5

It’s a trojan downloader. The malicious file resides in C:\Users{User}\msiexec.exe. It downloads additional files onto the infected computer.

More information about this Trojan: http://deletemalware.blogspot.com/2011/06/remove-msiexecexe-trojan-uninstall.html

Good luck!

6

Did you delete the file or send it to the recycle bin? ;D