ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
Found Trojans
E Chen


Joined: 12 May 2008
Posts: 11
Location: UK
Reply with quote
I'm relatively new to malware combat. I use Windows Vista Home Premium and have relied on Windows Defender and Norton 360 for protection.

A colleague recommended Clamwin so I downloaded and ran a scan.

Clamwin found the following:
C:\Program Files\Microsoft Works\lnchtour.exe: Trojan.Downloader.Banload-4568 FOUND
C:\Program Files\Online Services\AolUK\comps\acs\acssetup.exe: Trojan.Startpage-619 FOUND
C:\Program Files\Online Services\AolUK\stdnet_updater.exe: Trojan.Startpage-619 FOUND

The other malware protection has not found these items despite regularly updated definitions and frequent scans.

My problem is I don't know how long they've been there, how much damage has been done or how to safely get rid of them.

Can anyone advise?

Thanks in anticipation.

Best Regards

E Chen
View user's profileSend private message
GuitarBob


Joined: 09 Jul 2006
Posts: 3643
Location: USA
Reply with quote
You can set ClamWin preferences when it finds a virus to Report to you, to Remove it, or to put in in Quarantine. Choosing either Report or Quarantine are the best options. You do not want to remove a file if it is a false positive detection of a virus. I started out using Quarantine myself, but ClamWin once got a false positive on the Winlogon file, quarantined it, and I was unable to access Windows. So I would suggest using the Report option. ClamWin's scan summary will tell you if it found any viruses and their location on your computer. Note the location.

Before doing anything with an infected file, you should verify it is really infected. You can get a free scan of a file at Jotti--located at http://virusscan.jotti.org/ on the Web or at VirusTotal--located at http://www.virustotal.com/ on the Web. Go to either site, put the filename in the box, and scan it with multiple antivirus programs (including the Clam engine used by ClamWin). If several other virus scanners find the file is infected, it's probably for real, and you can safely remove the file by locating it on your hard drive, right clicking on the file name, and Delete it. You can do the same thing to a file in Quarantine to remove it. If the file was important to you, you will have to restore from backup (you do backup, right?).

ClamWin is not yet a full-time, resident, on-access virus scanner. It is still an on-demand file scanner--it doesn't scan constantly for viruses. So if you surf the Web a lot, you should have a resident scanner. ClamWin should work fine as a backup scanner to any resident scanner--like Norton. AntiVir, Avast, and AVG are all free resident scanners. The free Threatfire behavior blocker from PC Tools also makes a good combination with ClamWin. Windows Defender is a decent antispyware program when paired with a browser protecter like Spyware Blaster. You might be interested in these suggentions for free security software at http://sunbeltblog.blogspot.com/2005/08/security-on-cheap.html on the Web.

Regards,
View user's profileSend private message
E Chen


Joined: 12 May 2008
Posts: 11
Location: UK
Reply with quote
I have now been able to remove the Trojans. The files scanned positive for malware on both the sites suggested. I have removed them and rescanned to confirm their absence.

Thank you for your helpful advice.
View user's profileSend private message
loco_boy85


Joined: 09 Aug 2008
Posts: 1
Reply with quote
need help on removing trojans any suggestions
View user's profileSend private message
appcraft


Joined: 27 Aug 2008
Posts: 3
Reply with quote
First time here, and I had a possible trojan settings modifier /system32/ driver /host , after I restarted my PC after the download. Windows defender caught it and defined it as a kapersky.exe trojan. So what goes here ?? And does another virus scanner need to be used with this ClamWin or what??
View user's profileSend private message
Found Trojans
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic