Shaun Mccran

My digital playground

21
D
E
C
2009

How to remove sshnas.dll trojan (Remove trojan FakeAlert) and msa.exe

So whilst playing with some flash sites I managed to pick up the msa.exe virus, despite having a firewall (hard and soft) antivirus, and anti spyware.

It was the flsh injection virus, and it installed several files into windows 7, and a few sneaky .dll's to try and put it back again. SpyBot search and Destroy will kill it, and so will Microsoft Essentials.

SpyBot search and Destroy

http://www.safer-networking.org/en/spybotsd/index.html

Microsoft Essentials

http://www.microsoft.com/Security_Essentials/

Alternately follow these instructions, they worked for me.

sshnas.dll is a component of trojan FakeAlert. The trojan come from malicious websites that ask users to download an Adobe Flash Player update or player needed to view a movie online. The filename of the trojan is flash-HQ-plugin. Once started, the trojan will download and install core components: c.exe, msa.exe and sshnas.dll.

When downloaded, it will be configured to start automatically when Windows starts. Trojan FakeAlert may display many popups and fake security alerts, hijack Internet Explorer, disable Windows Task Manager and Registry editor.Also it is usually installed in conjunction with a rogue antispyware programs.

Download OTM by OldTimer from here and save it to desktop. (It looks a bit home made, but it works great.)

Run OTM. Copy, then paste the following text in "Paste Instructions for Items to be Moved" window (under the yellow bar):

view plain print about
1:services
2SSHNAS
3
4:reg
5[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
6"Videohost"=-
7"SSHNAS"=-
8
9:files
10%windir%\msa.exe
11%windir%\system32\sshnas.dll
12%windir%\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
13%windir%\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
14
15:Commands
16[emptytemp]
17[Reboot]

Click the red Moveit! button. When the tool is finished, it will produce a report for you. Then it will reboot the machine.

TweetBacks
Comments (Comment Moderation is enabled. Your comment will not appear until approved.)
Back to top