The picture displays a heapload of virusses of the same kind, Although Avast can find them, the program is unable to remove it.
Even Avast customer support let me down,i tried to (i don’t have a local isp provider e-mail) send the chested zip files to Virus@Avast.com, however when you make a zip called virus.zip, hotmail blocks off that its being send, gmail also blocks off i mailed about this to riley@avast.com Adam Riley(Technical Support) and i never heard anything back.
Why can’t Avast auto-upload the new virusses that it finds to Avast headquarters server?
Its so annoying, and Avast can’t get rid of this virus on my computer =( Anyway back to the virus.
If you zoom in on the pictures, you can see an e-mail adress, but it isn’t mine, its automatically generated by this virus, the moment you open up your hotmail or gmail, you will find that gmail is already logged in with a to you totally unknown mail adress. That’s seemingly what the virus does. Removing the exe’s from the temporary directory is useless , they seem to be generated (from what i’ve seen) from a file called setup.exe, on deleting that same file, it will just be generated back there next time you restart your computer.
it goes under a wide range of number-character executables like 58exgmtxt.1.exe or 37exinjs.a9.exe.
What is this and how do i get rid of it? Kind reminder is that doing a boot scan, and moving them into quarantine does not help. Avast at this moment is unable to remove this virus as it seems to be stuck in the running memory, windows wil not allow this file to be deleted.
People will blame, even due to privacy, if files from your computer are sent to avast, infected or false positive.
You can ‘add’ the file to Chest and send it from there.
If a virus is replicant (coming and coming again), you should:
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3).
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
I mean it would be nice if the option to upload was there (disabled by default) but your right about the privacy issues that you declared.
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3).
Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
Unbelievable (not joking) within 1 second after install startup AVG makes immediate notice about 25exinjs.a9.exe. And informs that unknowingly by its user that the computer is being used as a bot to attack other computers. risk = high , name Proxy.Horst.sv
Consequently it found another Trojan.Small.edz after scanning the local harddisks
I was a Lavasoft Spyware user, but have stepped today over into using AVG as i already was wondering why no one mentioned it ,probably due to the inferiority compared to AVG.
[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
-SUPERAntiSpyware detected these infected items that AVG did not.
at this moment im having trouble typing, a (program?) is stealing the focus of my cursor making this wepssss sorry will post back later im having trouble.
After running SUPERAntiSpyware again after reboot, my computer was to no avail still infected.
I was up to step 3, i thank you all for your kind support. Please notify that im doing all the actions of your recommendations as soon as possible. The scans unfortunatly take some time , and because the problem persists even after the scans it takes even more time to push thru the solution given in here.
I will get a hijack this log for you people available as soon as possible along with all the other recommendated solutions.
Avast Service files missing? at first glance, that can’t be a good thing. I put all my spyware programs in my special ANTI INTERNET folder anyway hope this log can show you some interesting features.
HJT beta 2.0 resolves the missing file as it doesn’t show the /service but you need to ignore any references to 023 entries for avast, this is a bug in the HJT 1.99.1. Hijackthis is searching for ‘C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe" /service’ (including double quotes and ‘/service’ parameter) as a file, this causes ‘file missing’, because only present is ‘C:\Arquivos de programas\Alwil Software\Avast4\ashMaiSv.exe’.
-Rebooted, virus is still in my system.
-d/l spyware terminator didn’t seem to do much , the virus remains.
-did a square deep scan, wonder what will showup.
-a-square is a program that i am(even tho its free) unfortunatly not satisfied with, it asks information at start-up before you can use it (asif your not having enough trouble with the virus already) and it traces and delcares directories of stuff that i use as problems.
-At first glance the most satisfying programs where AVG + Superantispyware + Windows Care,however non of them where able to get fully rid of the virus.
This completes up step 1 to 5.
-The above where the downsides,on a positive note even tho the virus persisted, my system has become insanly fast. I experienced a significant lag in my computer, even my moms laptop was faster then my highspeed hand build computer. I can say with certainty that that no longer is the case.
This was the sequence of actions I used to get rid of these damn files:
Check the processes of Windows Task Manager for .exe files with numbers followed by "exmodula" plus a letter, for example:
46exmodulag.exe
As it was written above, this name varies, in my computer I had several different files, some using "exmodulaf" and "exmodulag". End the process.
Next, go to your
C:\Documents and Settings\Rafael\Local Settings\Temp\
where "Rafael" varies according to the username on your computer. You´ll find several files that follow the format described above. (**exmodula*.exe). Delete them.
Now perform a search on your registry for the "exmodula" word you´ll probably find references to it in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List key. In this key you´ll find something like this:
C:\DOCUME~1\Rafael\LOCALS~1\Temp\46exmodulag.exe:*:Enabled:Microsoft Update
What this key does is to create a fake entry on Windos Firewall under the name "Windows Update" for each new **exmodula*.exe file it creates. Remove this entry from the registry.
I thought this was enough, but no, those damn files kept coming back after a while!
So I ran HijackThis 1.99.1 (wonderful little program by the way) and it found the file smss.exe (file responsible for automatic windows updates) running in the C:\WINDOWS\system\ folder, wich is wrong. This file is responsible for generating the **exmodula*.exe files. Delete it.
NOTICE: the smss.exe file running under C:\WINDOWS\system32\ is a legal file, do not touch it!
Now search your registry for smss.exe and you´ll find references to it under these keys, delete them.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_USERS\...\Software\Microsoft\Windows\ShellNoRoam\MUICache
Congratulations, it´s done. I hope Google will find this answer, the only reference to this trojan was made here. :)
anyway hope this log can show you some interesting features.