Trojan Horse Generic MRP? 1

[ADB100]

A relative got hit by a virus or spyware recently and I thought I managed to remove everything but one thing remains. The browser settings had been hijacked and about 3 programs were auto-starting when the PC was booted. I cleared all these out and reset the browser settings etc but AVG Antivirus 7.1 keeps finding more and more .dll files that is describes as 'Trojan Horse Generic MRP'. These are in the 'System Volume Information' folder on the systemdrive and are named 'Axxxxxx.dll' where 'x' is a random number. It seems to be replicating and more of these files appear.

How do I get rid of these and is there likely to be something else running that I have missed?

Thanks

Andy

 

[pechenegs]

you've been hit with the new WMF exploit.

go here and download the patch immediatley.

http://castlecops.com/a6450-Microsoft_Security_Bulletin_MS06_001_Official_WMF_Patch.html

then when installed run a few online scans below and ru these two programmes!



* Download the trial version of Ewido Security Suite here

http://www.ewido.net/en/

* Install ewido.
* During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
* Launch ewido
* It will prompt you to update click the OK button and it will go to the main screen
* On the left side of the main screen click update
* Click on Start and let it update.
* DO NOT run a scan yet. You will do that later in safe mode.


*Download Cleanup from Here

http://www.stevengould.org/software/cleanup/download.html

* A window will open and choose SAVE, then DESKTOP as the destination.
* On your Desktop, click on Cleanup40.exe icon.
* Then, click RUN and place a checkmark beside "I Agree"
* Then click NEXT followed by START and OK.
* A window will appear with many choices, keep all the defaults as set when the Slide Bar to the left is set to Standard Quality.
* Click OK
* DO NOT RUN IT YET



* Click here for info on how to boot to safe mode if you don't already know
how.

http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam

* Now copy these instructions to notepad and save them to your desktop. You
will need them to refer to in safe mode.


* Restart your computer into safe mode now. Perform the following steps in
safe mode:



* Run Ewido:

* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop


* Run Cleanup:

* Click on the "Cleanup" button and let it run.
* Once its done, close the program.




reboot to normal mode and run a few online scans!



Run an online antivirus check from

http://www.kaspersky.com/virusscanner

choose extended database for the scan!




Run ActiveScan online virus scan here

http://www.pandasoftware.com/products/activescan.htm

When the scan is finished, anything that it cannot clean have it delete it.
Make a note of the file location of anything that cannot be deleted so you
can delete it yourself.
- Save the results from the scan!