gsmtp185.google.com:25

[obake]

What a hell is this? In my pc a message apear in each five minutes and a weird icon apear next to clock. There's no way to make that icon go away! Double click, left button click, nothing! I put the cursor over it and shows: gsmtp185.google.com . I don't know what to do anymore!

Heres the message that apears:

           avast!: Communication Time with Internet

The connection time with internet expired. Keep wating?
                  (bpk.exe ->  gsmtp185.google.com:25)
                    _______                     _______
                   |    Yes    |                   |     No    |
                    _______                     _______

Doesn't matter wich button I push that massage still apear.
What should I do? Please help! And please forgive my poor english.

[essexboy]

I would suggest that you do a spyware scan using adaware, spybot or MS antispy. If you google using those names you will find them.  Download one or two and after updating them run a full scan. In fact I,ll get the addresses for you hang on a sec

[essexboy]

Adaware http://www.lavasoftusa.com/software/adaware/

Spybot   http://www.safer-networking.org/en/index.html

MS antispy  http://www.microsoft.com/downloads/details.aspx?FamilyId=321CD7A2-6A57-4C57-A8BD-DBF62EDA9671&displaylang=en


download, install then update at least one of these then run a full scan.  I recommend MS antispy cos it has a guard.

Then download install and update spyware blaster to keep you protected  http://www.javacoolsoftware.com/spywareblaster.html

[DavidR]

What is your email program?
Do you connect/check every 5 minutes for new email?

If you are using gmail you will need to set it up as it Uses SSL which avast does not support and it appears that you are trying to connect on the normal smtp port(port 25) not SSL. Do a forum search for gmail and stunnel for more information.

1. Try to extend the email and avast time outs.

Example for OE


Example for avast!


What firewall do you use?
Does it allow ashMaiSv.exe access.

[essexboy]

Ah it's a mail programme.  OOOOOOPs didn't know that it looked like a bit of spyware to me sorry

[DavidR]

It may be an email issue, but we need more information from 'obake' like the questions I asked and what he was doing when he received the error/warnings.

It could also be perfect keylogger lite if they have that installed but we need more information as a google search for bpk.exe returns lots of hits and possibilities.

By eliminating the possible issue it may point to other things such as perfect keylogger lite, so at this stage nothing is certain it could also be spyware.

[DavidR]

If you have perfect keylogger installed the recommendation is to uninstall it, see:
http://www.liutilities.com/products/wintaskspro/processlibrary/bpk/
http://www.auditmypc.com/process/bpk.asp

Google is your friend, a valuable tool - learn how to use the tool.

[obake]

Well, I already used MSAS and Spybot and it didn't work.

I don't use any program to see my e-mail.

Recently I discovered that one of my friends was installing Gunbound in the same time that he was making a download form Gmail and the mirc was open.

I've make an alteration on the avast! that DavidR sugest to me. Now I didn't see any results couse Windows found an error in bpk.exe so close the icon and the warings stoped. As soon as I restart my pc I post an answer.

Thank you so much to DavidR and essexboy for that help!

[essexboy]

Your welcome cos I'm still learning I didn't even think about Gmail

[DavidR]

Happy to have helped.

@essexboy
That's the purpose of the forums everyone learns a little each day (by folowing the threads) and are then able to help further next time.

[mertaydogdu]

Hi,
Just to help you I registered my self to here. because I tried to stop this trojan 1 week. And now I solved my problem. I hope this will help you.


I solved this problem. I am writing here if anybody has same problem by
this way they can solve this problem too.
Firstly How this trojan installed my computer? Somebodey sent me email
and email is about working at my company and email was turkish. I
opened CV.zip after this everything is started.
At every 5 minutes screen is freezing and sometimes it is opening new
window and it is sending emails by using gsmtp185.google.com ( I am
seeing it by Avast Antivirus)
How you can undestand this trojan. Easy control+alt+del and look
smss.exe is running or not. Probably yes but smss.exe is system
programme other one is virus. Means that your computer must have 2
smss.exe files at tas manager. When I tried first time I saw 1 smss.exe
but after frozen I wait and I saw 2 smss.exe files.
You cant stop this programme from task menager. So,
start -> run -> reg edit later find
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and delete smss.exe probably it is name is Winloader.
Later restart your computer. and "c:\windows\driver
cache\Winapp\AppData\ under this directory delete "smss.exe",
"MouseHook.dll", "ioerrors.txt", and  "img" . Which one yoour computer
has delete them.
It is ok.
This trojan is new! Started at 16.12.2006
It is akeylogger, screen capturer, spyware-trojan
Mert Aydogdu
mertaydogdu@yahoo.com
I hope this will help peoples...

[DavidR]

Welcome to the forums.

Thank you for your input, although this was an old topic, the malware is still doing the rounds.