Trojan horse Dropper.Small.24.A0

[name]

Hi.

Recently some computers have been infected with the following trojan:

http://www.ibbu.nl/~nsprakel/trojan.jpg

"Trojan horse Dropper.Small.24.AO"
(or is it "Trojan horse Dropper.Small.24.A0"?)

While AVG seems to detect it, it can't clean it.
I have scanned and cleaned the pc online using the following webpage:

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Anyone else out there who has any experience with this trojan?

 

[Art]

Hi.

Recently some computers have been infected with the following trojan:

http://www.ibbu.nl/~nsprakel/trojan.jpg

"Trojan horse Dropper.Small.24.AO"
(or is it "Trojan horse Dropper.Small.24.A0"?)

While AVG seems to detect it, it can't clean it.
I have scanned and cleaned the pc online using the following webpage:

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Anyone else out there who has any experience with this trojan?

Read this Sophos description by clicking on Advanced:

http://www.sophos.com/virusinfo/analyses/w32demotrya.html

See if the rundl32.exe file is in the registry Run key it mentions.
If so, delete the entry and reboot.

I suggest doing a scan with the Kaspersky scan engine via the
KASFX download from my web site.

Art

http://home.epix.net/~artnpeg

 

[name]

Read this Sophos description by clicking on Advanced:

http://www.sophos.com/virusinfo/analyses/w32demotrya.html

See if the rundl32.exe file is in the registry Run key it mentions.
If so, delete the entry and reboot.

I suggest doing a scan with the Kaspersky scan engine via the
KASFX download from my web site.

Art

http://home.epix.net/~artnpeg

Thanks for these suggestions. I don't have access right now to the
computers that might still be infected, but I'll post again in this
thread as soon as I've been able to check the reference to
"rundl32.exe" in the registry and scan them with KASFX.

 

[Gabriele Neukam]

On that special day, name, ([email protected]) said...

http://www.ibbu.nl/~nsprakel/trojan.jpg

A rundl(no second l)32.EXE in "Documents and Settings"? That's
definitely wrong

"Trojan horse Dropper.Small.24.AO"
(or is it "Trojan horse Dropper.Small.24.A0"?)

While AVG seems to detect it, it can't clean it.

Did you run AVG in Safe Mode? The "rundl32.exe" has to be inactivated,
ie removed by taskmanager or ingibited by a reboot into Safe Mode,
before Windows will aloow you to remove it.


Gabriele Neukam

(e-mail address removed)

 

[name]

Read this Sophos description by clicking on Advanced:

http://www.sophos.com/virusinfo/analyses/w32demotrya.html

See if the rundl32.exe file is in the registry Run key it mentions.
If so, delete the entry and reboot.

I searched and there is no reference to rundl32.exe anywhere in the
registry anymore.

http://www.ibbu.nl/~nsprakel/rundl32.jpg

I suggest doing a scan with the Kaspersky scan engine via the
KASFX download from my web site.

eScan AntiVirus Toolkit Utility Ver (4.4.7) doesn't seem to find any
virusses.

Well, I hope everything is fine now... I'll post again if I run into
anything suspicious.

Thanks again for your help.

 

[name]

On that special day, name, ([email protected]) said...


A rundl(no second l)32.EXE in "Documents and Settings"? That's
definitely wrong

Did you run AVG in Safe Mode?

Nope. But I subsequently used the online scanner mentioned in one of my
previous postings in this thread and it did manage to remove the
rundl32.exe file anyway, even though I didn't scan in safe mode.