Win32:Trojen-gen {other} - file infected changes name all the time

Viruses and worms
1

I have a tough one. I have tried most of the suggested helper tools identified in the threads here with no joy. The filename of the file keeps changing the pattern is “65exhmunmlcl41.exe” where the numbers in the file name keep changing every time I move or delete it through Avast.

I have to live with a constant avast! Warning dialog.

I have Googled for the root of the file name pattern with no success. seems that I am the only person in the world with this one!

Help!

M

2

:slight_smile: Hi :

SPECIFICALLY, WHICH “Helper Tools” have you used ? With the changing
File Name, I suspect you would be best helped by experienced, trained
certified, Volunteer “Malware-Fighters”, such as the “Microsoft Most
Valuable Profesionals” on the Forums at http://aumha.net .
The most competent person on the Avast Forums is “oldman” , when it comes
to “Situations” like yours .

3

Thanks. I have run:
avast cleaner
super aanti syware
spybot search and destry
mgtools
mlwarebytes
a couple others I can’t recall off the top of my head

M

4

I suggest:

  1. Disable System Restore and reenable it after step 3.
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  4. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.
5
I have Googled for the root of the file name pattern with no success. seems that I am the only person in the world with this one!

Nope. Try Googling “exhmunmlcl.exe”

Hello everyone,

I have the same problem since mid-June and a bit thanks to you I think I have found the solution. This is mainly due to software SUPERantiSpyware who found the solution. So that, I just delete the executable C: \ WINDOWS \ system \ smvss.exe and delete key in “regedit” using search and typing “smvss”! Personally, research has found that a single key and I just delete it. I did everything it this morning and since my anti-virus warns me not it has stopped “%% exhmunmlcl?. Exe” and that the problem is resolved.
I hope this solution will suit everyone.
Good day!

http://translate.google.com/translate?hl=en&sl=fr&u=http://www.commentcamarche.net/forum/affich-7139763-exmdnk&sa=X&oi=translate&resnum=4&ct=result&prev=/search%3Fq%3Dexhmunmlcl*.exe%26hl%3Den%26client%3Dopera%26rls%3Den%26hs%3DAc2%26sa%3DG

6

Thanks Frank… I confess, I did get a 2 Google hits when I searched that initially, but both were in another language. The first one I tried translating was still gibberish, so I never bothered with the other. With only two hits I figured the virus was really something else and I was after a red herring with that search.

At any rate, following those instructions in safe mode seems to have worked. Thanks a bunch for posting it.

Mike

7

I have the same problem! I have also zone alarm installed, and he is popping up from time to time with different file names (change only the numbers). I tried already a boot scan, and spybot search and destroy, but it keeps anoying me. At least zone alarm is blocking him any internet action.