Help with Win32:Trojano-279 please

[DBissett]

Yesterday I downloaded and successfully installed a new version of Tradestation software and used it all day fine.  This morning when I opened it I got a message from Avast that the file "whserver.exe" in that program contained the above virus.  I could not repair it.  (I use the free version of Avast and the menu item "disable VRDB is permanently checked").

I've tried everything I've read here to get rid of it.......I uninstalled the Tradestation program entirely, rebooted in SAFE mode, ran Avast thorough scan, AdAware and Spybot.  I even downloaded the program again (that firm said they've had no other complaints of a virus today, and I did use it without incident yesterday) and have attempted several reinstallations.   Each time Avast reports this virus in the same file but scanning with all of the above doesn't find it.  I've also run the hjt software and have a log if that would help.

I desparately need some advice from the experts here.  Thanks.

Dave

[DavidR]

Hi Dave, welcome to the forums.

Here are some places to get you started.

Eddy's HiJackThis Info and Analysis Then visit Eddy's HiJackThis pages, HijackThis log file analyzer and follow the directions there and get back to us if you need more help....

User's FAQ A visit to the thread will give you a lot of useful advice and an idea of the information needed to Help you fully.

General Advice & Tools for virus/trojan/malware removal

If you need more help, come back here with more info....

The win32:Trojano topic has cropped up many times, so a search on these forums for win32:Trojano should also return further information.

HTH David

Edit: you might want to monitor this thread because it also mentions Tradestation, as a possible false positive.
http://forum.avast.com/index.php?board=2;action=display;threadid=6922

[DBissett]

I just came home from the office, attempted to log onto Tradestation on my home computer and got the very same virus message from Avast.  This machine hasn't been used since yesterday, like the one at my office.  I noticed that both machines downloaded new databases today.  The Tradestation program will not operate now on either computer.   IF this is a false positive then it has to be cleared up and I'm stuck at the moment as to how to do that.

Dave

[Eddy]

Send the file(s) in a password protected zip to virus@avast.com Mention in the email that you think it is a false positive and why you think it is. Don't forget to put the password also in the mail

This way Alwil's lab can correct it for a future vps version.

[Pavel Baudis]

I confirm this was a false alarm which has been removed in the latest update.

Sorry for any inconvenience
Pavel

[Jlo]

Thanks for the quick update Pavel!

Avast rules again!!

Kind Regards

Jlo

[Eddy]

Dang, I was just about to scan my system to see if it gave false positives here also. But Alwil was fast again so now I have the corrected vps already before I could start scanning ROFL

[DBissett]

Wonderful.  Thanks for the quick correction of this false alarm thing.  

Dave