VIRUS

Yep.

Go to this site, run their FREE virus scan. When the Trojan shows up, delete it right there. I've had to do that when our 27 year old son picked up a virus while chatting on Yahoo.


http://housecall.trendmicro.com/

Try deleting it first. Here's a link to some more specific details on it.

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_AGENT.X

Just search for sysupd.exe and then note the location.

logon in MS-DOS mode and then delete that file sysupd.exe then, go there to the TEMP Folder, the location your said NAV pointed to above, and delete the _UPDATE file as well as clear all the files in that directory then after you logon in normal mode, check again with NAV

However, it's probably going to be gone once you use the free scan from Trend / Housecall antivirus.

Diane

 

WinXP can be a *real* bear to work with once stuff gets into the registry...

What I am about to tell you is 'dangerous' because it requires you to modify your registry...

And, messing with your registry can render your PC inoperative until technical help works on it.

But, if you *only* search for the specific file noted as the trojan source file. You *should* be alright.

Here's the problem...

In Windows, especially WinXP, once something is in the registry and loaded it is marked as being in use... That's why you can't delete it. It's in the registry as 'in-use' and Windows thinks it has to have it...

One reason the scan from Trend Micro didn't work was you proibably do not have full administrative rights to the registry... Therefore you, and, by default, any program you run can't make changes to the registry leaving you stuck with an entry that prevents you from healing your computer.

The *Safest* way to proceed is to re-run the on-line scans with full Administrative Rights enabled on your PC.

That *should* enable the on-line scan to remove both the registry entry and the source file(s).


If that doesn't work... (The version of trojan you have may be a new mutation)

Go to Karenware.com and download RegRipper and the VB6 Runtime... You may also like Cookie Viewer and Registry Pruner...

These are FREE for home use...

Once both VB6 Runtime and RegRipper is installed run Reg Ripper and do a search (with all check boxes enabled) for the Trojan File...

At the bottom of the screen there is a checkbox that says 'delete after saving' You want that checked because you are trying to remove the entries.

Follow the instructions and save (using a useful filename) the removed registry entires then allow then to be deleted.

(Saving the removed entries allows you to double-click on the .REG file to re-install them if you accidently break your system...)

After which you should be able to manually delete the affected files.

Note: you can also edit the resulting .REG file using any text editor. This is useful if you accidently include something in the deletion you shouldn't have

Again, **WARNING** it is possible when 'playing' in the registry to make WinXP not boot requiring a trip to the Tech Center. Or, you re-installing Windows yourself.

BUT... If you have one of those blasted 'Restore' disks you could lose (and probably will) everything you personally have added to your system...

That's why I won't buy a system without a standalone Windows install disk. Windows is pretty good about picking up after itself when allowed to do so on it's own...

But, a 'Restore' disk is just a Disk Image and overwrites **EVERYTHING** on the hard disk...