sysreg.exe / trojan horse

[phantom999]

Hey, had to quaratine C:\window\system\sysreg.exe
Norton could not repair. Norton said infected with Trojan horse and recommeded quarantine.
Question: Now I cannot run\read \or install programs from disk without sysreg.exe. How to fix.

 

[jrbarnett]

Rather than write out the instructions, I will direct you to Symantec's response to removing it with Norton.

http://securityresponse.symantec.com/avcenter/venc/data/security.risk.html

John

 

[mattjurado]

Sysreg is a trojan tool that downloads stuff, removing it shouldn't affect your ability to run other programs. Update your Norton and do a full scan, sounds like there might be other viruses. If the problem persists, post some more specific details.

Matt

 

[phantom999]

NAV did not always mark as virus. One day it did and I qaurantined the sysreg.exe. On May 27 went to NAV site. NAV said to open quarantine file and 'delete'. After deleting, did virus scan-no virus. But still have the problem now. Did not have the problem when sysreg.exe was in quarantine. (correct, does not affect running files on CD-dif prob).

 

[killowhat]

http://www.mpsmits.com/message_boards/trojan_horses.shtml

give it a read.

 

[mattjurado]

I'm still unclear about the details of the problem...

You said " Now I cannot run\read \or install programs from disk ".

What exactly does this mean? Do you get errors when you run any programs off the hard drive?

Matt

 

[phantom999]

*\trjan horses.shtml - I'm giving this a read.

 

[rockerfellerz]

This is a link to a trojan cleaner/protector

http://www.moosoft.com/thecleaner

It has a 30 day free trial..

If you're going through Hell...keep going... (Winston Churchill)
RocKeRFelLerZ

 

[phantom999]

Results:
NAV controlled virus when select 'quarantine'.
NAV did not delete virus when select 'delete'.
Use directions in web site offered by jrbarnett - to manually clean registery,
Then search for files update.exe and delete.
PS. Have not tried the download from moosoft.com
I will see if this has fixed the problem first.
Thanks all.