how to locate hidden trojan horse that repeatedly installs spyware

[Ross K.]

Hello all,
Unfortunately my PC has been infected with what I am
guessing is a hidden trojan horse. Symantec Anti-virus
can't find it. Whatever it is, it repeatedly installs
several files on my PC with XP Home 5.1 Build
2600.xpsp2.030422-1633: Service Pack 1. Some of the files
are .exe (nthpwwrr.exe, wupdt.exe, wupdsnff.exe,
systb.exe, and maybe others), and some are registry mod.
attempts. Thank goodness for Adwatch by Lavasoft, which
pops up each time and shows repeated attempts to mod. my
registry. I successfully blocked those attempts with
Adwatch, then use Ad-aware to clean my files, then I
restart. Thereafter, at a random time, the same .exe
files are installed again and registry mod. attempts
again. One more thing: When I look at the running
processes, I find that nthpwwrr.exe is running. If I kill
that process, then delete nthpwwrr.exe, then run Ad-aware
to clean the PC's files, no more installation attempts
are made for many hours, maybe up to a day. SO.... Is
there some audit trail that I can view that would show me
what is installing these files? Any other solution? THANK
YOU IN ADVANCE FOR ANY HELP!
Kind regards,
Ross K.

 

[Guest]

Maybe try checking SERVICES, certain spyware/trojan installs itself as a
Windows SERVICES which start AUTOMATICALLY when Windows starts up.

For info removing entry in SERVICES, try a search on Google.

As for anti-spyware program, a combination of Spybot SD, AdAware and Giant
Anti Spyware works well in my machine.