Trojan Horse

[rak sa_ngop]

This afternoon I was not able to access my True hi-speed Navigator program due to a 'Component MSWINSCK.OCX or one of its dependencies not correctly registered, a file is missing or invalid' error message.

I ran the AVG virus program and it detected this file as a "trojan horse generic 3.GOH" which it "successfully" dealt with.

However although the file did not then appear in the path directory, as soon as I ran the hi-speed Navigator again, this file reappears and so does the error message. In fact AVG also has the comment "back-up copy, infected" .

The good news is that a VERY HELPFUL lady with good English on the TRUE helpline told me how to reconnect to True internet so now in my Network Connections window I have under Broadband... #True disconnected.... #True ADSL disconnected......#True2 connected

To tell you the truth I do not understand what the difference is between ADSL and the True connection.

So my questions are:

How do I get rid of the Trojan horse and run hi-speed Navigator again?

Do I actually need the ADSL connection up or is the True2 connection doing the same job?

(Basically I just want an internet connection for the net and am not interested in the True range of services).

Hope the above makes sense to somebody out there because it's a hot can of worms to me!

Help please.

[cdnvic]

Reboot your computer and go into safe mode (press F5 or F8 when windows begins loading). Try the scan again. This should work unless it's being installed by a rootkit and I'm going to look into that now.

[cdnvic]

If you aren't already doing so, download the antispyware program at http://www.ewido.net/

It's one of the best and it's also free. This program is quite good at dealing with embedded trojans and rootkits.

[rak sa_ngop]

Reboot your computer and go into safe mode (press F5 or F8 when windows begins loading). Try the scan again. This should work unless it's being installed by a rootkit and I'm going to look into that now.

Sorry if I am being difficult, but I have seen so many references to "reboot the PC in the normal fashion" without ever seeing any explanation as to how do you actually reboot a PC. Do I have to use the 'bootable' diskette?

My PC came with next to no advice for the novice PC owner!

Thanks cdnvic

[cdnvic]

When you restart the PC hit F8 when windows starts to load. Choose "safe mode" from the options.

If F8 doesn't work, try again with F5.

This loads Windows with only the barest amount of resources needed to operate so that malware on the system won't start.

Then you can run your antispyware and antivirus programs and they should get the infection this time.

I looked it up and there isn't any rootkits that are associated with this trojan.

[Mamboking]

Just change your antvirus program to be Avast. It's free and this program found on my laptop two trojans that McAfee cannot find. As well as if it's kill virus, its will be really "dead".

[cdnvic]

Just change your antvirus program to be Avast. It's free and this program found on my laptop two trojans that McAfee cannot find. As well as if it's kill virus, its will be really "dead".

Changing your AV won't make a difference because if the infection is a running program then it can't be deleted, hence safe-mode.

I'm no fan of AVG, but in this case switching to Avast won't help.

[Pattayatony]

Just change your antvirus program to be Avast. It's free and this program found on my laptop two trojans that McAfee cannot find. As well as if it's kill virus, its will be really "dead".

Changing your AV won't make a difference because if the infection is a running program then it can't be deleted, hence safe-mode.

I'm no fan of AVG, but in this case switching to Avast won't help.

cdnvic thanks for all of your help when I was having problems and you put me onto Avast and I think its great.

Thanks again

Cheers Tony

[cdnvic]

Glad to have helped

[rak sa_ngop]

This is what I did:

I rebooted the PC

I downloaded Avast and Ewido (AVG 7.5) as recommended by cdnvic and mamboking

I ran the following in Normal (Non-safe) mode:

AVG Free Edition

AVG 7.5

Avast

Spybot

Adaware

Only my old faithful AVG Free Edition detected the Trojan horse

I restarted PC in Safe mode

Repeated the above progs and none detected the Trojan but still cannot run hi-speed Navigator

After repeated attempts at reinstalling hi-speed Navigator from CD I somehow managed to get into an 'upgrade version' window and upgraded successfully.

Everything back to normal now

After wasting all day only two things to say:

1. Thanks to cdnvic and mamboking et al

2. F**KING COMPUTERS!!!

[cdnvic]

Glad it's gone. Just make sure that the Avast and AVG aren't running at the same time or they'll cause conflicts.

Edited March 8, 2007 by cdnvic

[rak sa_ngop]

Just out of interest in the Network Connections window under Broadband I now have:

#....True connected.........#True2 disconnected ........#True ADSL disconnected

Are these just 'names' for same True connection and I only need one to be connected?