Stubborn Trojans

[taurusnipple]

Alright, hate asking things in PC Advice but I'm stumped right now.

On my home computer I ran AVG (updated too) and it found the following:

Belt.exe Trojanhorse Downloader. Stubby.A
A0303668.CPY Trojanhorse Downloader.Revop.A

Now AVG says its going to restart the PC to get the crap off, but upon reboot and another scan, these trojans are still there. So, I went into Safe mode and tried deleting with no luck. Manual deletion doesn't work either from safe or otherwise, I get the same message: Access denied, source file may be in use, cannot delete, you know the one.

So, options?

[marcus]

Tried a different AV program? Give something like McAfee a go. Any unusual processes running in task manager?

[Ish]

Have you checked the startup settings in the registry?

I had to delete allsorts of stuff out of there before the clean up would actually completely clean up when I was fixing my neighbours virus infested PC lately.

I think there here:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce

But there might be other bits under the different HKEY_ thingies.

[Crispin]

yeah, the goold old start > run > msconfig allows you to easily see what's running at start-up in the various registry keys.

If in doubt about some of the ones in the process list in taskmanager, go on to google and type in the executable's name. Then it'll tell you what it is. Also, some MS office processes reinstall themselves even after you've deleted them from the registry keys. Don't worry about these. You have to go onto to MS's website to find out how to remove these (they're mostly pointless anyway, to do with alternate methods of device input into office).

[Super Stu]

I forget what I had after reinstalling windows recently (5mins online sans wall with an unpatched xp is lethal, heh), but my registry was riddled with references to wuamgrd.exe. Check the various keys Ish suggested to find anything out of the ordinary then search the whole reg for it.

And Msconfig can't hurt.

AVG got rid of the virus, for what it's worth, but didn't clean up the registry. I shouldn't think mcafee will?

[fifty?ballz]

If you have system restore enabled, sometimes it will keep restoring the trojan
every time you delete it.

Make sure system restore is disabled and delete the trojan keys that hijackthis
shows. A good AV like NOD32 set at deep heuristics should help too.

[gingerj]

run startup mechanic... To clean any processes that are run on boot once you've disabled anythign that could have some link to the trojan you wanna remove run your remover again have another go at deleting it....

[taurusnipple]

Thanks everyone

Should have this sorted shortly