Trojan Mosucker

[Malakili]

Can anyone offer any advice in removing this trojan? My virus scanner detected and cleaned it, but after restart it appears to be back. It appears to be respawning itself on restart. I`ve looked in my start up files and in running services (xp box) and see nothing suspicious. I also read up that it places a key in your registry. In HKEY_LOCAL_MACHINE>Software>Microsoft >Windows>Current Version>Run
HKEY_LOCAL_MACHINE>Software>Microsoft >Windows>Current Version>RunServices
but i have nothing related to in the Run key, and don`t have the 2nd key at all in my reg. Also discovered that it drops a WININIT.INI & WFMWMDV.LOG into windows dir, as well as editing Winstart.bat & System .ini. I don`t have the any of these files with the exception of system.ini, which apparently gets SVR12.EXE added to the boot section of it. I`m also led to beleive that this trojan is memory resident. Anyone think of anywhere else it could be starting from, its getting frustrating having to clean it at boot up all the time.

Many Thanks

 

[Svensson]

Hello Malakili!

Have you got a antivirus boot disk? If you have, then boot from it and do a new scan on the computer. If you havent, then try to make one on a computer that insnt infected and then boot the intected one with it and do a new scan.

I hope this helps you.
Daniel Svensson