A trojan in Windows XP ??

[Guest]

I have installed Anti-Vir and I get a mesage that I have a trojan horse.
Message is Trojan horse Windows\system32\MLJJH.DLL is trojan horse TR/crypt.0

I am unable to delete or quarantine this file. Is it really a virus in
Windows or part of the operating system? Or is Anti-Vir just making a
mistake. Either way we have a ciontinual pop-up warning of this "virus'

 

[Guest]

Tolley, when you try to delete it, do you get a access denied to file message
of some sort? If you do try running in safe mode and delete it through that
option.

Restart your computer ---> continue to hit your F8 key ---> select safe mode
option,

I have had that issue before. Good Luck

Oscar

Silver Spring, MD
(e-mail address removed)

 

[Pegasus \(MVP\)]

I have installed Anti-Vir and I get a mesage that I have a trojan horse.
Message is Trojan horse Windows\system32\MLJJH.DLL is trojan horse TR/crypt.0

I am unable to delete or quarantine this file. Is it really a virus in
Windows or part of the operating system? Or is Anti-Vir just making a
mistake. Either way we have a ciontinual pop-up warning of this "virus'

Just because this file is in the System32 folder does not mean
that it is a Windows file. Anyone could have placed it there!
It is certainly not in my own System32 folder.

Reboot the machine in Safe Mode, then try to rename it to
something else. You should also check Google for this file -
it's probably spyware.

 

[Guest]

Thanks for that. Even in safe mode I could not delete or re-name the file.
However I managed to open the file in Wordpad and then deleted all the code.
So it appears that although the file in still there, it is empty and
hopefully I wont have any serious problems with it. Would like to know what
it has been doing in my system for the last couple of days though!!
Cheers!

 

[Wesley Vogel]

MLJJH.DLL is a BHO: MSEvents Object, it is part of Vundo.B adware variant.
There are more files involved, wineula.dll, req.dat and wineula.dll

See removal instructions here...

How to remove the Trojan.Vundo.B / Search42.com / MSevent / Req.dat
Redirector
http://www.bleepingcomputer.com/for...arch42com-MSevents-tx18610-0.html#entry110599

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In