Farhan said:
i been reported by avast a virus found in kernel32.dll named
win32
atched-KX[Tn] trojan horse.
but i cant remove it using move/rename/delete/move to chest options.
only i can do is NO ACTION.
generally it activates if i start a program i.e. browser, notepad etc.
what do i do?
thanx in advance
Farhan
If I've pieced it together right, and I may not have, this is a
previously "fake" trojan used to infect machines to get people to buy
removal tools and has recently been revised to become an actual trojan.
In most places it seems to be a trojan, not a virus.
From the lack of data around for it, I'd guess this is a fairly new
event. The rotten part is, if I'm right, it has modified/replaced or
otherwise damaged one or more DLL's your system needs to run. Many AV
programs reportedly won't offer to fix the problem since quarantine etc.
of those DLLs would crash the machine.
F-Secure seems to have the most data on it, at least from my meager
research:
http://www.f-secure.com/v-descs/trojan_win32_patched.shtml :
Trojan:W32/Patched
Name : Trojan:W32/Patched
Category: Malware
Type: Trojan
Platform: W32
Summary
Files detected as "Trojan.Win32.Patched" are usually Windows components
that are patched by a malicious application. The purpose of patching
varies. For example, certain malware patches system components in order
to disable security, such as the Windows Safe File Check feature. Other
malware can add parts of its code to a system component and then patch
certain functions of the original file to point to an appended code. The
most frequently patched components are:
winlogon.exe
wininet.dll
kernel32.dll
iexplore.exe
Disinfection
It is not advised to delete, rename or quarantine patched Windows
components because it may affect system stability. Even though Windows
locks its main files while it is active, it might be still possible to
affect them.
If your F-Secure Anti-Virus detected a certain file as
Trojan.Win32.Patched, please first try to select the "Disinfect" action.
In this case, F-Secure Anti-Virus will create a copy of a patched file,
try to restore its contents, and then it will add a renaming command
into the Windows Registry in order to replace the patched file with a
cleaned one during the next Windows startup.
In case the approach described above fails, try to restore one of the
recent System Restore points. In many cases a patched system component
will be replaced with a clean one. Before restoring a System Restore
point it is advised to backup all personal data to avoid loosing it when
Windows rolls back to a previously saved state.
Windows Installation discs contain a repair option. Boot from the CD and
select the option to repair. Again, it is advised to backup your
personal data.
If nothing helps to clean an patched system component, the last resort
is to attach a hard drive with a patched file as slave to a similar
Windows-based system, boot up and to replace a patched file with a file
taken from a clean system. Note that a file used for replacement must be
the same version as a patched file! This operation should be done by an
experienced computer technician only.
Additional Details
Achtung: False Positive Notification
The 2008-11-04_04 database contained a false positive on a German
language Windows XP Service Pack 2 file called User32.dll.
The detection was named Trojan.Win32.Patched.dn and is resolved in the
2008-11-04_06 update.
If you were alerted to Trojan.Win32.Patched.dn, please make sure that
you have the most current update, and that User32.dll has not been
renamed.
The User32.dll is located in the C:\WINDOWS\system32 folder.
------------------------------------
At this point I would recommend the malwarebytes etc. that have already
been mentioned since this is primarily a trojan and not really a virus.
They may be faster and better at finding it. BEWARE: DO NOT quarantine
or delete .dll files until you have replacements or known good originals
for them or have a boot disk to let you reinstall them.
If those failed, then I'd say visit a few reputable web sites like
Symantec, McAfee and F-Secure, find their online scans and run those.
I'd do them last because they're rather time consuming.
Much as I hate to say it, if none of the above helps, it's probably time
to consider rebuilding the whole drive from scratch, delete & recreate
partitions and start over.
HTH,
Twayne`
