Expert: Brian Benosky - 11/4/2008

Question
Hello. Im asking this question as regards to my friends computer, in which that i use just like its my own. We both spend alot of time on it.
But his computer has a very persistant virus that would not delete, quarentine, rename/move in anyway. And would always return no matter what constantly. His anti-virus i installed for him worked, but it was a trail version somehow and stopped updating for like a month or so and i returned to his house to find out, so i reinstalled it for him and had it a full version. And updated it. Not long after update thats when the warning message continues to flash on and on about a viruse that would not go away.
Its called Katrina.dat
And after discovering this...i begin to piece together something, cause we have realized that something has been constantly running Internet Explorer as a process in task manager nearly every 10 minutes, slowing down the pc cause its trying to open more than one. So we have to continue closing internet explorer process. (and by the way, we dont even use internet explorer, we use firefox).
I was assuming from anaylising the behavior and after updating the anti-virus software that the Katrina.dat file is responsible.
How should we dispose of this file, because nothing seems to work.

Answer
Hello Reagen

Please download HijackThis to your desktop from here:

http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Make sure you close EVERY open window and ALL browser windows. The only thing that should be open is the HijackThis program.
Double-click on the file you just downloaded.
Click on the "Install" button.
Upon install, HijackThis should open for you.
Should it not open, go to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
Choose 'Do a system scan and save a log file'.
Copy the text file which opens in Notepad and paste it in a follow-up  here.
   * Do not fix any entries in HijackThis, as they may be harmless.