Trojan in msurl\32.exe

Norton advised me of a Trojan in C:\windows\system32\msurl\32.exe. I did a
virus check in safe mode and it found three instances of it which it could
not clean so I took the option to quarantine them. Now when I reboot I get a
message saying that the (now quarantined) file cannot be found and to make
sure that it exists or to remove it from the registry. Is this a file that I
need to re-install from somewhere or can I safely delete the registry
reference, if I can find it.
Derek.

In Message-ID:<c3ef9n$27e1m4$1@ID-107529.news.uni-berlin.de> posted on
Fri, 19 Mar 2004 09:42:15 -0000, Derek F wrote:

>Norton advised me of a Trojan in C:\windows\system32\msurl\32.exe. I did a
>virus check in safe mode and it found three instances of it which it could
>not clean so I took the option to quarantine them. Now when I reboot I get a
>message saying that the (now quarantined) file cannot be found and to make
>sure that it exists or to remove it from the registry. Is this a file that I
>need to re-install from somewhere or can I safely delete the registry
>reference, if I can find it.
>Derek.
>

Run hijackthis and note the entries under category 04,
you should be able to delete the key with the "fix checked" option.
http://www.spychecker.com/program/hijackthis.html
Direct download:
http://files.webattack.com/localdl834/hijackthis.zip

--

Bart

"Bart Bailey" <me2@privacy.net> wrote in message
news:405bc872.6295577@bart.spawar.mil...
> In Message-ID:<c3ef9n$27e1m4$1@ID-107529.news.uni-berlin.de> posted on
> Fri, 19 Mar 2004 09:42:15 -0000, Derek F wrote:
>
> >Norton advised me of a Trojan in C:\windows\system32\msurl\32.exe. I did
a
> >virus check in safe mode and it found three instances of it which it
could
> >not clean so I took the option to quarantine them. Now when I reboot I
get a
> >message saying that the (now quarantined) file cannot be found and to
make
> >sure that it exists or to remove it from the registry. Is this a file
that I
> >need to re-install from somewhere or can I safely delete the registry
> >reference, if I can find it.
> >Derek.
> >
>
> Run hijackthis and note the entries under category 04,
> you should be able to delete the key with the "fix checked" option.
> http://www.spychecker.com/program/hijackthis.html
> Direct download:
> http://files.webattack.com/localdl834/hijackthis.zip
>
> --
>
> Bart
Thank you. There was also an entry in F1 which referred to an entry in
boot.ini. I could not see it in boot.ini but I did delete F1.
Derek.