Trojan Horse Virus in my computer 1

[kiernanf]

I use AGV anti-virus. It tells me that some (4) of my files have been infected with a trojan horse virus. When I scan the drive, AGV does not remove or cure these files.

I purchased a Trojan & Virus program and it says exerything is fine.

What should I do?

 

[SESaskDFC]

Howdy:

What is the trojan AVG is finding and what and where are the infected files located??

Also, what is your operating system??

Murray

 

[kiernanf]

There are two Trojans (Trojan Horse BackDoor.Mard & Trojan Horse Hide Window).

Locations are:
C:\WINNT\System32\meminstall.exe\import\exporer.exe
C:\WINNT\System32\meminstall.exe\import\gpiresul.exe
C:\WINNT\System32\import\meminstall.exe\import\explorer.exe
C:\WINNT\System32\import\meminstall.exe\import\gpiresul.exe

My system is Windows 2000 professional.

Thanks

 

[SESaskDFC]

Howdy:

As per Trend..

Do a rescan after using Trends online scanner at

http://www.antivirus.com

Launch Registry Editor. Click Start>Run, type REGEDIT then hit the Enter key.
In the left panel of the Registry Editor, double click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows
>CurrentVersion>RunServices
In the right panel, look for and then delete this registry entry:
LoadProfile “C:\Windows\SYSTEM\Rundll.exe”
Close the Registry Editor.
Restart your computer.


Then, lose your Mirc program.. that's how they are getting in..

Murray

 

[kiernanf]

Murray,
Thanks for the tip.
I went to Trends and did the online scan. They fond nothing.
I ran AGV again with the same result as before (4 infected files). I deleted these files with no adverse effect (so far).
I could not find Mirc or the registery file HKEY_LOCAL_MACHINE>Software>Microsoft>Windows >CurrentVersion>RunServices
on my computer.

 

[AVChap]

The "infected files" are in a self-extracting file MEMINSTALL.EXE under the System32 and System32\Import directories. Just delete the file.

HTH, AVChap
... my $1 worth of advise, 2cents isn't enough due to inflation

 

[PrideOfManchester]

Hi mate

I had the same problem -

I couldn't find MEMINSTALL.exe - but I could find MEM.exe - should I delete this?

The problem I've had is that my antivirus software (AVG and antivurs.com) both deleted the trojan but when I start up Windows I now get the message in an update pop up box -

*/run:unable to open 'svchost32.exe' (line4, nvnav32g.dll)

I presume the programme hadsn't been fully deleted.

Cheers
Neil