Okay, how do I get rid of this???

H

H. David Pembrook

I'm running Windows XP. I use Anti-Vir for my virus protection and Zone Alarm
for a firewall. The Anti-Vir found the following results.......

C:\
explorer.cab
ArchiveType: CAB (Microsoft)
--> explorer.exe
[DETECTION] The Trojan horse TR/Dldr.Small.OR
C:\Program Files\AVPersonal\INFECTED
HOME[1].EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Delf.CB.3
WAS DELETED!
INTRON.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Delf.CB.3
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.001
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.002
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.003
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.VIR
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
PROMPT[1].HTM.001
[DETECTION] Contains signature of the worm Worm/Rbot.LD.1
WAS DELETED!
PROMPT[1].HTM.VIR
[DETECTION] Contains signature of the worm Worm/Rbot.LD.1
WAS DELETED!
WINADX.DLL.VIR
[DETECTION] The Trojan horse TR/Winad.A
WAS DELETED!

Anti-Vir would not delete The Trojan horse TR/Dldr.Small.OR because it was in
an archive file. I also note that a program "twink64.exe" asked permission of
Zone Alarm for access to the Internet which I denied.

How do I get rid of the Trojan Horse from the archive file? Anti-Vir doesn't
give me any suggestions.

I might add that this PC is owned by me but has been kept at my work office
where it's used by other employees when I'm not at work. God only knows what
they've been doing with it. Also, I ran the latest edition of Ad-Aware and
found 64 items. Many were associated with www.coolweb.com or some such
bullshit. I also suspect I've got a browser hijacker on the PC.

TIA for any assistance.

~~~~~
"When a true genius appears in the world,
you may know him by this sign, that the dunces
are all in confederacy against him."

- Jonathan Swift
 
S

Smoker

H. David Pembrook said:
I'm running Windows XP. I use Anti-Vir for my virus protection and Zone Alarm
for a firewall. The Anti-Vir found the following results.......

C:\
explorer.cab
ArchiveType: CAB (Microsoft)
--> explorer.exe
[DETECTION] The Trojan horse TR/Dldr.Small.OR
C:\Program Files\AVPersonal\INFECTED
HOME[1].EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Delf.CB.3
WAS DELETED!
INTRON.EXE.VIR
[DETECTION] The Trojan horse TR/Dldr.Delf.CB.3
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.001
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.002
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.003
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
MEDIATICKETSINSTALLER.OCX.VIR
[DETECTION] Contains signature of the dropper DR/LowZones.A.1
WAS DELETED!
PROMPT[1].HTM.001
[DETECTION] Contains signature of the worm Worm/Rbot.LD.1
WAS DELETED!
PROMPT[1].HTM.VIR
[DETECTION] Contains signature of the worm Worm/Rbot.LD.1
WAS DELETED!
WINADX.DLL.VIR
[DETECTION] The Trojan horse TR/Winad.A
WAS DELETED!

Anti-Vir would not delete The Trojan horse TR/Dldr.Small.OR because it was in
an archive file. I also note that a program "twink64.exe" asked permission of
Zone Alarm for access to the Internet which I denied.

How do I get rid of the Trojan Horse from the archive file? Anti-Vir doesn't
give me any suggestions.

I might add that this PC is owned by me but has been kept at my work office
where it's used by other employees when I'm not at work. God only knows what
they've been doing with it. Also, I ran the latest edition of Ad-Aware and
found 64 items. Many were associated with www.coolweb.com or some such
bullshit. I also suspect I've got a browser hijacker on the PC.

TIA for any assistance.

~~~~~
There's a dialog posted in a forum with an expert helping out a guy in your
situation, step by step:
http://forums.spywareinfo.com/index.php?showtopic=24367
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top