Expert: Lorry - 1/1/2006

Question
hi,
i have avast version 4.6 home edition anti virus software on windows XP professional ver2002, service pack 2  - the following warnings keep appearing:

http://85.255.115.186/users/fill/web/images/idemlog.exe contains version of Win32:Trojano-3233

http://85.255.115.186/users/fill/web/images/sphlp32.jpg contains version of Win32:Adan-094

http://85.255.115.186/users/fill/web/images/pppcgm.jpg contains version of Win32:Adan-078 [Adw]

http://85.255.113.43/dgprpsetup.exe contains version of Win32:Dialer-gen. [Trj]

when connected to internet they occur every 10min or so. ita almost as if a popup program has downloaded itself and keeps trying to open these pages but the anti virus software stops it.

i downloaded "Ad-Aware SE Personal" but when scan it finds nothing.

Can you please help
thankyou
colin

Answer
Hi Colin,

Even though you have Avast installed, I would suggest that you go to: http://sarc.com/  Scroll down and click on,"Free Online Virus and Security Check" and run the virus check. Write down exactly anything it finds, then return to: http://sarc.com/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually.

I would also suggest downloading Spybot - Search & Destroy 1.4, a program that removes spyware, available from:

http://www.pcworld.com/downloads/file_description/0,fid,22262,00.asp

Once installed, enable Tea Timer. Open the Spybot Search & Destroy, click  the "+" sign next to Tools on the left side of the screen, click System Startup, then on the right side of the page check HK_CU Run Spybot Tea Timer.

The Resident TeaTimer is a new tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options, how to deal with this process in the future.

Make sure you check for updates before running. If you have trouble getting the updates, near the top of the Update Window, click the little arrow next See-Cure  #1(Europe), highlight the next one on the list, See-Cure #2 and try to download the updates. If that doesn't work, try the next one the list. until you get one you can download from. Being a free program, if too many people are using the same site to download the updates, some people will not get them.

Happy New Year!
Lorry