New Trojan???

[whocares]

Hi Cassie,

WHICH other / Onlinescanners did you use ? results ?
you know that you can exlude files from scanning in both the mainscanner and the resident shield ?
 

[Ms. Brooke]

If it helps, I've removed the file, since the computer that its on doesn't need the wireless and I've experienced no difficulties since. I've received a clean scan from Avast now that it's gone, but I'm still none the wiser as to what was wrong with the file.

Kinda makes you wonder what you're laying money out for. But then, what do I know... I'm just a Llama.

[Cassie]

WHICH other / Onlinescanners did you use ? results ?
you know that you can exlude files from scanning in both the mainscanner and the resident shield ?
 

Those recommended on this forum as well as Norton (yes, hog but I was desperate) as well as a couple others.  The results were always the same - clean system.  Thus my confusion and frustration were born  ::argh!!::

Seriously, I'm ready to dumb Avast - this is getting way too muddy.  You mention  excluding files but what files do I exclude?  Each time the ****** popup appears it has a different file listed as "infected" but I can't find the source of the infection, my 'puter works great and my cats are ready to put me away for growling.  

??
Cassie

[whocares]

1) Those recommended on this forum as well as Norton
2)Each time the ****** popup appears it has a different file listed as "infected"

Hi Cassie,

1) Including KAV ? Please list them all ...

2) This imho doesn't really point to a false alarm:
but on each occurence, NOTE exactly the full path/location/filename & move them to the chest, or better to a new separate folder and send them in again
to virus@avast.com or virus@asw.cz with info on file location and a link to this topic.
pack the file into an encrypted Zip (i.e. with password) and include password in the mailtext

P.S.: always different names ? I thought, it was "iassam.exe" ?
and the fact that nothing can be found on google about the above filename, also points against a false alarm



 

[whocares]

you could also send it in to
newvirus@kaspersky.com
 or
virus@rokop-security.de

to have it analyzed for free

-> State that you suspect either a new trojan, or a false alarm
 

[buttercup]

I am getting the same problem    Very frusterating because I can not get rid of it.  BTW I do have a wireless connection.


Butercup

[Expendable]

I first picked up the same Trojan in DXDIAGN.exe last night. Same symptoms, can't repair, moved it to my chest.

Just now I've picked it up in kbdne.exe and msratelc.exe, and moved them to my chest. All three in the C:\Windows\System32 path.

In fact, just as I typed this, it appeared again in rsmps.exe.

So far, except for the first instance, the alert occurs when I open text files, not .doc files or anything else. I noticed that the filename and path does NOT correspond to the name or path of the file I opened. Google isn't finding much of anything, other than this thread, and something in what I think is Spanish.

[whocares]

and something in what I think is Spanish.

Please post the link/URL
 

[Expendable]

http://www.avast.com/i_idt_1405.html

It's just avast in a different language.

[whocares]

Hi,
Have you UPDATED avast ?

again: move files not to chest, but to a new, empty folder..
then pause!!! avast shield & test the file(s) with Trend, RAV & KAV (Links above) + do a full scan with SPYBOT, Ad-Aware & cwshredder

-> if they all don't show infections in the files, send in the files to avast stating it's a false alarm
- move files back to their original locations and exclude them from detection in mainscanner and GUARD

[Person1123]

Hello everyone,
 I Also somehow got this virus and I'm useing wireless dsl. I got the same exact trogan except it's infected my notepad. Everytime I try opening it The trogan warning would pop up. The file that Avast said was infected was called C:\WINDOWS\system32\nddenb32.exe . I've tried everything you've guys said and I've come up with the same results as the others...This trogan can't be a false alarm, my notepad won't work  now :'(

[TypeX]

Win32: Trojano-090

Hey, I just found out I got this virus as well just 2 hours ago, and have spent the last two frikkin hours trying to diagnose this program.  It has corrupted my Notepad and I only noticed this virus when I tried to view an html source code about 2 hours ago.  

I'm running Windows XP Pro, Avast, Sygate Personal Firewall, and I don't see how I got this virus.  I am fanatic about Internet privacy to the point of running Adware everyday, deep scanning with Avast every night, and I still fail to understand how I got this virus.

I've deleted the whatever was found through pre-scheduled Avast scan before Windows boot, and my notepad is back.  So far everything seems normal.  

I've also dug into the web, and as noted by another member, was unable to find anything regarding this trojan.  

 

[Person1123]

I've deleted the whatever was found through pre-scheduled Avast scan before Windows boot, and my notepad is back.  So far everything seems normal.

I've tried deleting it, but it won't go away. So I tried moving it to the chest and then deleting it, but it still won't leave   You got your notpad back? How did you manage to delete the trogan? Manually?

[TypeX]

Boot up Windows in Safe Mode, then run Avast for a scan.  It should find the virus/files/problem right away, and will ask you if you want to schedule a scan before windows boots up (before the virus is run in memory).  Say yes to reboot Windows.  Windows will reboot and the scan will start immediately.  Whatever files it found I deleted right away.  

The scan should take about 10-20 minutes to complete.  When everything is said and done, boot up Windows normally.  You will find that at first notepad seems to be gone or is missing.  Delete the notepad shortcut in your Start>Programs>Acessories folder because that shortcut no longer works.  You can find Notepad in C:\WINDOWS and create a shortcut to replace your old one if you like.

Another side effect that I've found is Microsoft Word file association.  If you double click on the .doc file, it will say that the file is either corrupt or missing.  You can do a right click > open with MS Word and check the "Always use the selected program to open this kind of file" option to regain the association.

[Person1123]

Avast didn't find it, after I placed it in safe mode, and scaned the computer... I've also downloaded the lastest updates so I don't get what I did wrong  

Are you sure all you did was placed it in safe mode and then started scanning?