Win32:Kuang2 and Win32:CTX

Viruses and worms
1

Hi,

This is my first time posting here - I have looked through the various threads but I just get more confused.

I help administer 2 forums - both using smf 1.1.2. For a long time, I got their Email Notifications as they should look and the message is in the body of the Email not as an attachment.

A reply has been posted to a topic you are watching by *********.

View the reply at: http://www.webpagefun.com/forum/index.php?***************#new

Unsubscribe to this topic by clicking here: http://www.webpagefun.com/forum/index.php?****************
More replies may be posted, but you won’t receive any more notifications until you read the topic.

Regards,
The Web Page Fun Team.

Now I get the Notification as an attachment (using OE 6) and then I get double notification in the body of the Email. The Email now looks like this:

(VPS 000716-3, 23/02/2007), Inbound message X-Antivirus-Status: Clean

A reply has been posted to a topic you are watching by *********
View the reply at: http://www.webpagefun.com/forum/index.php?***********#new

Unsubscribe to this topic by clicking here: http://www.webpagefun.com/forum/index.php?action=notify;***********
More replies may be posted, but you won’t receive any more notifications until you read the topic.

Regards,
The Web Page Fun Team.set=ISO-8859-1
Content-Transfer-Encoding: 7bit

A reply has been posted to a topic you are watching by*********
View the reply at: http://www.webpagefun.com/forum/index.php?************#new

Unsubscribe to this topic by clicking here: http://www.webpagefun.com/forum/index.php?action=notify;**********
More replies may be posted, but you won’t receive any more notifications until you read the topic.

Regards,
The Web Page Fun Team.
–SMF-e3b2216eb6007ff1df0daff47faaff27–

I am the only one that gets the Emails this way. I did post on the smf support forum recently and I also have the same problem with the Emails received from that forum.

Viruses: At first - Avast said I had a virus Win32: Agent-EUF if I remember correctly. I moved the 2 files in question to the virus chest. I then did a boot scan twice and everything came up clean. This was Tuesday. Interesting - I had just done the regular weekly scan the Monday PM and everything was okay. The problem with the Emails started before this by a couple of days?

Now a boot scan says I have Win32: CTX and Win32:Kuang2 - both of these are in C:\System Volume Information. I also have the Win32;Kuang2 in the Pavdll.dll file from PCPitstop (I did a virus scan from there also). I disabled System Restore, rebooted and the boot scan now comes up clean. I have left the files in the virus chest.

I am still having the same problem with the Emails. I haven’t had any solutions from the smf support forum. I don’t understand why things were fine for so long and all of a sudden - the Emails change. I haven’t changed the OE settings and I don’t see that they have been changed unless I am missing something.

Would this problem indeed stem from a virus or would a setting be changed in my Avast Pro program? Any suggestions as to how to fix this? Oh, I did uninstall Avast and then reinstalled but that didn’t make any difference.

Thanks kindly for any help. I use Windows XP Home if that makes a difference.

2

Placing them in the chest was the right choice. You could submit the files to virustotal, an online multi scanners http://www.virustotal.com/en/indexf.html and see if any other avs also detect them as infected. You can’t submit from the chest.

The pcpistop file may just be unencrypted info that pitstop uses for their online scans. Panda has a similar problem.

As for your email, sometimes I get emails with attachments that are visible in the preview panel or when I open the email, so it would seem that you are seeing both the email and attachment. Why you would recieve a notification as an attachment seems strange. I can’t think of anything that OE or avast on your end would do to cause this.

BTW welcome to the forum.

3

Hi Oldman,

This is the Oldlady! :slight_smile: Thanks for your quick response and your welcome to the forum.

I forgot to put that I tried to use the virustotal site last PM but it just says the file is 0 kb. I also tried again today to use this site and another site which was mentioned here by someone else - virusscan.jotti. The virusscan.jotti site said there was perhaps malware or my firewall which was preventing the file from opening. I did disable my firewall (Kerio) but I still was unsuccessful.

Re the Email - I have the Preview Pane turned off but when I use to open such a Notification Email - there was no attachment and I would see the content in the body of the Email - the way my first ‘quote’ shows.

4

Have you found a resolution to your problem yet? This forum has been updated to the same version of software that the forum with which you are recieving the double notifications from is using. How do the notifications from here look, if you have it turned on?