OK, I worked on this for 5 hours. I too used the Volume ID change program when upgrading my HD. All of the processes above did not work to delete this trojan, they did however give me several clues and some great links.
I am running Trend Micro 2005 and there is nothing about this Trojan.Grobt on their website. Here is what I did to delete the Trojan.
First, I went to the Bitdefender website and d/l a 30 day copy of there virus program.
Then, turn off your exiting virus protection and/or uninstall if you have a high speed internet connection. I did not do this and I paid a 2 hour price trying to resolve confilcts, it took forever to load BD, but finally did.
Then update Bitdefender and do a scan on the Winnt directory, BAM, found the following and moved them to Quarantine:
c:\winnt\system32\wmram.exe infected: Trojan.Grobt
c:\winnt\system32\winifo.dll infected: Trojan.Grobt
c:\winnt\system32\wmpcld.dll infected: Trojan.Grobt
c:\winnt\system32\stunel.dll infected: Trojan.Grobt
Additional files that were found later were DC34.exe & DC33.exe with the same trojan.
These two files:
c:\winnt\system32\wmpcld.dll infected: Trojan.Grobt
c:\winnt\system32\stunel.dll infected: Trojan.Grobt
may reside in a different location, but BD will find them.
As soon as the scan was complete I checked my running processes and found that WMRAM / WININFO were not running. I went to the registery and deleted all references to these 4 files. (Backup [export] first).
Do a full system scan with BD, this will take a couple of hours. I was shocked as to all the stuff it found, mostly in the email backups starting in Feb of 2000.
I first started using BD about 1.5 years ago and liked it but it was very slow. I changed to Trend Micro. After this, I think I will return to BD, they have come a long way in a year & a half.....
Hope this helps guys...
