What creature is "MSNUPDATE!@#@.EXE" ???

system · 2006-11-05T01:11:13.000Z

Whenever and always as I open my “MSN EXPLORER” browser, my “Prevx Home” gives me the following “Intrusion Warnings”:

The application msn is trying to READ, DELETE the protected file/directory
C:\PROGRAM FILES\MSN\MSNUPDATE!@#@.EXE
The application msn is trying to DELETE the protected file/directory
C:\PROGRAM FILES\MSN\MSNUPDATE!@#@.EXE

, which I can either Allow or Deny !

By the way “Prevx Home” explains:

“” Install Attempt (*.exe)
This is due to a protected file or directory in the Program Files directory being modified. Windows updates and software installations/configurations may modify these files. If you are not installing or updating any programs, then this may be malicious activity. “”

I allow each time, the “DELETE” of this file (MSNUPDATE!@#@.EXE) to happen, because it:

has a strange name, nowhere in Google to be found.
I cannot under any circumstances find it in my PC (in
the above directory and Avast shows no
virus/worm there either).
It is known that a worm called
“Backdoor.Win32.Codbot.z” hides in the same
directory in “msnupdate.exe” and has
the following capabilities:
"# Allows others to access the computer
Downloads code from the Internet

Reduces system security

Installs itself in the Registry

Exploits system or software vulnerabilities "

By the way my PC was under control of a hacker for 2 months by two trojans (now removed) but I still see suspicious periodic escape of bytes, when I’m online.

Now my questions:
Am I taking the correct action by "Allow"ing the “application msn” to “DELETE” it??
And why is this file nowhere to be found (also in hidden files)?

Thanks a lot for your explanation & recommendations!

Lisandro · 2006-11-05T12:58:09.000Z

Are you using Windows XP?
Can you schedule a boot-time scanning?
Start avast! > Right click the skin > Schedule a boot-time scanning.
Select for scanning archives.
Boot.

Access denied - like when you can’t delete a file - means, generally, that the file is in use by another process (program) and cannot be repaired/cleaned/moved/handled by avast!

If a virus is replicant (coming and coming again), you should:

Disable System Restore on Windows XP: http://support.microsoft.com/default.aspx?scid=kb;[LN];310405
Clean your temporary files.
Schedule a boot time scanning with avast as I’ve wrote before.
Use a-squared, Free AVG Antispyware, SUPERantispyware or Spyware Terminator (trojan removers).

system · 2006-11-05T19:40:16.000Z

Hi :

 Perhaps you should ask on the Prevx Support Forum at

 www.castlecops.com/f146-Prevx1.html   !?

system · 2006-11-05T21:42:24.000Z

It might just be some strangeness from an incomplete installation or incomplete update.

You could try uninstalling the program, reboot, run a registry cleaner, manually remove any left overs, and reinstall the program. I would disable Prevx during the uninstall and reinstall.

This is just a guess, however.

Announcements