win32:trojan-gen. {delphi}

[Flee]

i have a serious problem with this worm, avast says it cant delete it.. I hope you guys can help me out.. I would really apreciate that

[Summoner Yuna]

this is a generic detection. in order to help with removal I need a specific name. run housecall http://housecall.trendmicro.com and tell me the name of the trojan it finds.

[Flee]

i runned the housecall and it found: win3d:Dialui[trj]  (filename  C:\DOCUME~1\Even\LOCALS~1\Temp\V4OG3Ca02340)...last day avast said that a file under the name "kernel.exe" was infected.. im not so sure with this + I am n00b

[Summoner Yuna]

tell house call to delete this file or tell avast to delete it either way


let avast delete kernel.exe.

[Flee]

its not that easy, i've tried over and over to delete the trojan(delphi), avast just gets errors when I try to delete it..but,the other trojan(win32:dialui[trj]) was no problem to remove.. what can i do to get rid of that other ignoring trojan?  

[Summoner Yuna]

have you tried to scan with avast in safe mode?

[Flee]

I scanned in safe mode, found the trojans and got stuck with error when trying to delete..

[whocares]

Hi,

reboot the PC in safeMode, login as Admin, make sure that avast resident shield is not running (pause it if necessary).
THen navigate with file explorer to the TEMP-folder in your first posting, and delete ALL files in it

do a thorough scan (including archives) of the whole system while still in safemode
if the trojan is gone, reboot normally
if not: please post the full/complete/exact path to the file that avast finds the trojan in

- apply all Windows updates
-  check/close/secure your network shares
- Install, update, scan and fix with:
spybot, ad-aware, cwshredder (DL-Links here via the board search)
- secure IE-Browser: /disable/restrict ActiveX & scripting
-exercise caution when surfing in the future

 

[Flee]

yeah
it worked!

thanks so much for helping me

[RejZoR]

Hehe you'd just have to terminate trojan process running in the background