UNSOLVED
trojan gema and horse
during a routine virus scan I have 5 infected files. They are:
intmgr.exe- Gema
pwr32ctr.exe -Gema
setup.exe- horse (Thought for sure this was a gema at first)
sndcompat.exe -Gema
YMQH8NPTX1.exe- Horse
I quarantine all of them, went to symantec to get the instructions to delete them from my registry. (had a trojan horse 6 mths or more and removed in with no problem wininetd.exe) when I went to my registry I could not find any value that were even close to the file names above. I looked in all the areas that was on the instructions and even more and couldn't find anything close.
So my question is now what? Could I just delete them out of quarantine?
and Is it possible since I remove aol instant messaging that I could have deleted the virus. ( since I downloaded aol for my son it seems thats when I started to get viruses)
When I run a full system virus scan it shows no infected files.
Thanks in advance for any help
ChrisRLG
2 Intern
•
3945 Posts
132
0
Posted January 11th, 2004 14:00
I would go to one of the online virus scanners (Several are listed on my website, AV section - link below) such as housecall (try NOT to use the same as your current AV) and run that, that would check your machine. It may show the items in quartine, if so you should be able to see from the file location if that is what is found.
If that then proves clean, just be aware that your AV did its job, and saved you from an infection. If not clean and that AV is unable to remove, try this :-
------------------------
A post of a hijackthis log for the experts to advise.
HijackThis From Here
Download, run, scan, save log, then in notepad copy the FULL log by copy and paste as a reply to this post and an expert with HijackThis Knowldge, will have a go at giving advice. Please note the list of experts names below, very few forum regulars here have had this training.
DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.
Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.
TomCoyote (of http://tomcoyote.org/forums/index.php fame)
YoKenny (Accredited Expert at TomCoyotes)
baskar1234 (Spyware Classroom Teaching Assistant at TomCoyotes)
ChrisRLG (Spyware Classroom Teaching Assistant at TomCoyotes)
Yellowhammer (In Training at TomCoyotes)
therock247uk (In Training at TomCoyotes)
irelynmisses (In Training at TomCoyotes)
You could also go to one of the more specalist forums where more experts will be able to help.
http://tomcoyote.org/forums/index.php
http://forums.spywareinfo.com/index.php
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi (Home of Spybot S&D)
http://boards.cexx.org/index.php
Do read the sites FAQ before posting, and advise your problem and what steps you have already done to try to cure your problem.
I, and the other hijack experts mentioned above, are in all those sites (and more) with the same login names. You might get one of us at those sites also to anwser your log, but other experts will also be available.