Vírus? Spyware? Mania da perseguição? (fixed)

e por acaso não sabes como é que apago isto, não?

quanto a onde o apanhei tenho quase a certeza onde foi.... e posso garantir que não fui eu :x2: (pelo menos desta vez :002:)
 
Executa o msconfig e procura esse processo na lista do arranque, depois desactiva-o.
Por fim procurao no disco rigido e apaga-o.
Tambem podes tentar instalar o spybot e fazer um scan.
 
mr.bohemia disse:
e por acaso não sabes como é que apago isto, não?
Clicar para expandir...

Vê lá se te ajuda. :)
metem-se a ver sites de meninas e dá nisto :P

Retirado de: http://www.commentcamarche.net/forum/affich-2090178-xxexmodulae-exe-inconu-du-web

Hello, I live in Brazil and I was having the same problem described above, and I found a solution (I´m sorry for posting in english, I can´t write in French, had to use Babelfish do translate your messages above).

This was the sequence of actions I used to get rid of these damn files:

Check the processes of Windows Task Manager for .exe files with numbers followed by "exmodula" plus a letter, for example:

46exmodulag.exe

As it was written above, this name varies, in my computer I had several different files, some using "exmodulaf" and "exmodulag". End the process.

Next, go to your

C:\Documents and Settings\Rafael\Local Settings\Temp\

where "Rafael" varies according to the username on your computer. You´ll find several files that follow the format described above. (**exmodula*.exe). Delete them.

Now perform a search on your registry for the "exmodula" word you´ll probably find references to it in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List key. In this key you´ll find something like this:

C:\DOCUME~1\Rafael\LOCALS~1\Temp\46exmodulag.exe:*:Enabled:Microsoft Update

What this key does is to create a fake entry on Windos Firewall under the name "Windows Update" for each new **exmodula*.exe file it creates. Remove this entry from the registry.

I thought this was enough, but no, those damn files kept coming back after a while!

So I ran HijackThis 1.99.1 (wonderful little program by the way) and it found the file smss.exe (file responsible for automatic windows updates) running in the C:\WINDOWS\system\ folder, wich is wrong. This file is responsible for generating the **exmodula*.exe files. Delete it.

NOTICE: the smss.exe file running under C:\WINDOWS\system32\ is a legal file, do not touch it!

Now search your registry for smss.exe and you´ll find references to it under these keys, delete them.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_USERS\...\Software\Microsoft\Windows\ShellNoRoam\MUICache

Congratulations, it´s done. I hope Google will find this answer, the only reference to this trojan was made here. :)
Clicar para expandir...
 
Winjer disse:
Executa o msconfig e procura esse processo na lista do arranque, depois desactiva-o.
Por fim procurao no disco rigido e apaga-o.
Tambem podes tentar instalar o spybot e fazer um scan.
Clicar para expandir...
Faz isto em modo de segurança do windows, para o Windows não executar esse ficheiro e conseguires apagar tudo à vontade.
 
os ******* voltaram, daquilo que o vortex69 disse, só não fiz isto:
"Now perform a search on your registry for the "exmodula" word you´ll probably find references to it in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S haredAccess\Parameters\FirewallPolicy\StandardProf ile\AuthorizedApplications\List key. In this key you´ll find something like this:

C:\DOCUME~1\Rafael\LOCALS~1\Temp\46exmodulag.exe:* :Enabled:Microsoft Update

What this key does is to create a fake entry on Windos Firewall under the name "Windows Update" for each new **exmodula*.exe file it creates. Remove this entry from the registry. "

será por isto? :rolleyes:
 
Inicie sessão ou registe-se para poder participar.
Back
Topo