Trojan removal

shopbot

Hi All,
I have just completed a virus scan using Mcafee. It flagged up 11 files with the prockill.df trojan. According to the scanner it could not clean, delete or quarantine two of the files.

I want to be able to post exact details here but I cannot find the virus scan log within Securty Centre. Any ideas where it is?

What are my next steps...do I run Mcafee again in safe mode?
What I do find concerning is that some files I thought would be safe came up as infected (One was CCleaner set up)

Thanks

SB

Fran

If you do a google search with the exact terms you'll find out more about the trojans. Antivirus removal software is not so good at removing trojans, you should try running Ewido in safe mode (and any other software you have). You might need to turn off system restore to remove any files that are still there (but check on websites when you do google search to see how to remove, there may be a removal tool).

shopbot

Hi Fran,
I tried Google without success. Mcafees own website shows that the virus was discovered today and was put into their updates today. It sounds like it has only just surfaced.

Thanks

SB

shopbot

On the McAfee website it says:
Prockill-DF There have been reports of an incorrect identification in the 4629 DAT files of certain installer packages. This will be corrected in the 4630 DATs

Does that mean that this is highlighting some items as Trojans that are not in fact threats?
Does that mean my PC is not infected?

Fran

That's how I would interpret it too, but there's no harm in running Ewido anyway as it's good. Perhaps then check back later/tomorrow to see if anything more comes up.

shopbot

Thanks Fran,
I'm downloading Ewido now and will run overnight.

SB

shopbot

I ran Ewido overnight. V impressed as it picked up two bits of spyware that MSantispyware/adadware/spybot had missed! It did not pick up the Trojans that McAfee did. I then ran McAcfee (with system restore off and in safe mode) again and it picked up Ewido-setup.exe as a Trojan. This morning there was a another McAfee update available so my guess is that the previous update was corrupted and giving 'false positives'.
I'll scan again tonight after work and see what hapens!

-TangleFoot-

Rather unnervingly, a very similar thing happened with AVG just the other day...

shopbot

All sorted now! I think it was a corrupted definitions file. Might try AVG when my McAfee subscription runs out....