trojan.wimad.a

I am trying to help my brother clean a trojan off of his computer. He is running Vista Home Premium. The trojan is trojan.wimad.a ... it was originally found by AVG AV... and was originally listed as trojan horse generic5.ijc. I have been searching google for a solution, and found a forum that suggested running Ewido in safemode. Looks like Ewido got bought out by Grisoft, so now it is AVG Anti-Spyware. Regardless, we downloaded it, booted to safemode, and started a scan. Pretty early on in the scan we got an information balloon that said:

Quote:

---

c:\c:\$Recycle.bin\s-1-5-21-2501116068-1111772687-1608448203-1000\$row5w3j is corrupt and unreadable please run the chkdsk utility.

---

We have not yet run the check disk utility... I was wondering if anyone here had come across this.

here are some other steps that were taken:

Ran AVG AV in normal and safemode, both times it found the trojan but was unable to remove it, reported 1 error and 0 files healed.

Ran Spybot S&D, but found no evidence of a Trojan.

Ran Adaware 2007 in safemode, it found the trojan and claimed to quarantine it, but after that we ran AVG AV again and the trojan was still there.

Ran Hijack this, and pasted the log file at hijackthis.de. There were no "nasty" entries.

We are currently still in the middle of the AVG Spyware scan in safemode.

All of the software and definitions are up to date.

It is getting late, and I am getting ready to go home. So I will probably continue this battle sometime in the next couple of days.

Any help is greatly appreciated.

Thanks for your time.

Westin

well... just got this email from my brother, looks like the problem is cleared up... when he originally saw the infection, he navigated to the directory that the file in question was reported to reside in, and deleted the folder... I guess that is why the chkdisk thing came up... here is his email:

Quote:

---

I downloaded Avast! And ran it. It found a WMA file with the Trojan horse in the same directory we had deleted. It was able to quarantine it. I then ran AVG only to have the same file pop up again. I shut the system down, ran chkdsk, then booted up in safe mode. I ran AVG again, and it still popped up. I then went to the disk cleanup util and ran it. Then I thought, “I ought to run the disk defrag.” So I did. I think the directory I deleted was still resident on the HD. After running defrag, the directory didn’t even show up during the scan.

---

any insight? I could probably muster some... but :drink: it is about time for bed...

Hi,

I use this tool:

http://www.ccleaner.com/

It cleans out all sorts of places where nasties tend to hide ;)

Incidentally, it might be a good idea to create a new system restore point and delete the old ones?

Thanks nihil... your advice is always most appreciated. :) I will do that when I get over there tonight...

Quote:

---

Ran Adaware 2007 in safemode, it found the trojan and claimed to quarantine it, but after that we ran AVG AV again and the trojan was still there.

---

Was AVG scanning the Adaware quarantine folder?

Quote:

---

Originally Posted by AngelicKnight

Was AVG scanning the Adaware quarantine folder?

---

excellent question... I am not sure, but that could very well have been the case...

Most AV's or Antispyware apps will find the file if it's been saved to the systemvolumeinformation folder (restore points, folders are hidden), as a quarantined item.

Each system restore point is a chain so you need to flush all the restore points and not just the folder with the infected file...;)

Thanks for the info dalek... I went over tonight, ran ccleaner, and went to delete/create restore points, and there was only one... from today. Not sure what happened to the other ones... the computer is still coming up clean on the scans, so I am optimistically thinking that the problem is resolved... though any more tips or insight is still greatly appreciated... once again thanks to everyone for their ideas and suggestions.

Cheers!
Westin

I use the same tool that Nihil has suggested for over a year now - It works great to flush out most things.

I had used it before, but I always thought of it as more of a privacy tool than a malware eradicator... looks like it is effective in both ways... it is a very handy piece of software... :)

Hi westin,

I have been using it since back in the days of PIIs and Windows 98 :shocked:

Back then, HDDs were very small, RAM was slow and expensive, and you had to manage your resources much more carefully.

It actually came out as a "system optimisation tool" but over the years I have seen it develop enhanced privacy and anti-malware capabilities.

:)

Nihil,

What's this tool you speak of, and how in the world have I somehow missed the apparent kagillion times you've suggested it? :eek:

nihil, wasn't ccleaner originally crap cleaner?

Hi westin,

Yes, it used to be "Crap Cleaner" and is now maintained by a UK outfit called Piriform.

They have a blog: http://www.piriform.com/blog

I haven't tried the file defragmenter, but the recovery tool (Recuva) seems OK (I have only tried it on Win2000 and XP)

AK,

I don't know how you missed it other than that you seem to reimage rather than repair? I don't have that option very often, so I use CC to give me a level playing field. ;)

Quote:

---

you seem to reimage rather than repair?

---

Yes, you're right on the money there. That's pretty much the attitude of the IT department where I work...if the solution takes too long to find, backup and reimage. We have an Altiris Deployment Server where everything's automated...plug the troubling box in, click a couple of things on the Altiris console, then everything else from reimaging to program reinstallation is all automated soon as the server sends the box a wake-on-lan signal. Copy backuped data back over, send back to user, move on with day.

I've only been here a little over two months. It's a rather different take on things for me, given the last place I worked, reimaging was the last option. :eek:

AK

I agree that it speeds up the process of troubleshooting which can take from a few mins to days. How are people supposed to know what went wrong and how to fix it if its just plugged in and reimaged ... I suppose in a big corporation is would minimize downtime to a certasin extent but I like to know how to fix the problemo ...

Oh, as do I, but I don't exactly have that option in my position...

don't forget CCleaner also ha a basic registry checker / cleaner built in
and under tools, it will show a list of progs it is able to uninstall, and a startup list too
not just a bat file any more :p