I'm relatively new to malware combat. I use Windows Vista Home Premium and have relied on Windows Defender and Norton 360 for protection.

A colleague recommended Clamwin so I downloaded and ran a scan.

Clamwin found the following:
C:\Program Files\Microsoft Works\lnchtour.exe: Trojan.Downloader.Banload-4568 FOUND
C:\Program Files\Online Services\AolUK\comps\acs\acssetup.exe: Trojan.Startpage-619 FOUND
C:\Program Files\Online Services\AolUK\stdnet_updater.exe: Trojan.Startpage-619 FOUND

The other malware protection has not found these items despite regularly updated definitions and frequent scans.

My problem is I don't know how long they've been there, how much damage has been done or how to safely get rid of them.

Can anyone advise?

Thanks in anticipation.

Best Regards

E Chen

You can set ClamWin preferences when it finds a virus to Report to you, to Remove it, or to put in in Quarantine. Choosing either Report or Quarantine are the best options. You do not want to remove a file if it is a false positive detection of a virus. I started out using Quarantine myself, but ClamWin once got a false positive on the Winlogon file, quarantined it, and I was unable to access Windows. So I would suggest using the Report option. ClamWin's scan summary will tell you if it found any viruses and their location on your computer. Note the location.

Before doing anything with an infected file, you should verify it is really infected. You can get a free scan of a file at Jotti--located at https://virusscan.jotti.org/ on the Web or at VirusTotal--located at https://www.virustotal.com/ on the Web. Go to either site, put the filename in the box, and scan it with multiple antivirus programs (including the Clam engine used by ClamWin). If several other virus scanners find the file is infected, it's probably for real, and you can safely remove the file by locating it on your hard drive, right clicking on the file name, and Delete it. You can do the same thing to a file in Quarantine to remove it. If the file was important to you, you will have to restore from backup (you do backup, right?).

ClamWin is not yet a full-time, resident, on-access virus scanner. It is still an on-demand file scanner--it doesn't scan constantly for viruses. So if you surf the Web a lot, you should have a resident scanner. ClamWin should work fine as a backup scanner to any resident scanner--like Norton. AntiVir, Avast, and AVG are all free resident scanners. The free Threatfire behavior blocker from PC Tools also makes a good combination with ClamWin. Windows Defender is a decent antispyware program when paired with a browser protecter like Spyware Blaster. You might be interested in these suggentions for free security software at https://sunbeltblog.blogspot.com/2005/08/security-on-cheap.html on the Web.

Regards,

I have now been able to remove the Trojans. The files scanned positive for malware on both the sites suggested. I have removed them and rescanned to confirm their absence.

Thank you for your helpful advice.

need help on removing trojans any suggestions

First time here, and I had a possible trojan settings modifier /system32/ driver /host , after I restarted my PC after the download. Windows defender caught it and defined it as a kapersky.exe trojan. So what goes here ?? And does another virus scanner need to be used with this ClamWin or what??