Help with a Virus

I was hit by one of the Backdoor.Trojan viruses recently, and it infected itself to 3 of my files (winktdl.exe, winvtdl.exe and winsclt.exe) all in the Windows\System 32 directory. Norton caught the attack, and I Quaranteened the first two files, and then deleted them. The last file could neither be Quaranteened nor deleted normally. However, I went into the C:\ prompt and thus was able to delete the file winsclt.exe.

Since deleting each of these files I have not noticed any affect on the operation of my system. Also, I manually check for new virus definition files at Norton each day. I have run repeated Norton virus scans and the infection has apparently been cured.

QUESTION: What are the above files, which were infected, related to in Windows XP, and do I need to acquire and reload them onto my system?

orchided

 

I don't find any of those files on my XP Home system so it's possible that they were all created by the trojan. I may not have the same software installed as you so there is still a possibility you may have a problem with some particular program.

Try everything out and if it all works...

Good luck.

 

Thanks Zephlyr. I will engage each of the programs on my system and see if I run into difficulty with any of them. With my lack of expertise, it never entered my mind to do as you suggested - I just assumed that these were Win XP files.

Again, I thank you!

orchided

 

You may want to check this out. The virus opens a backdoor also and writes some registry keys:

http://vil.nai.com/vil/content/v_99409.htm

 

Thank you very much GusD. I pray that I have rid myself of the sucker. Interestingly, my Norton definition file was up to date when I got hit. The hit occured while I was downloading/installing an MSOffice patch from MS's update pages. I was going to email MS; however, I figured that would be a non-fruitful venture.

Again, I thank both you and Zephyr for your inputs!

orchided

 

AV's are good at detecting viruses, but not so good at detecting trojans. You may, therefore, wish to consider backing up your AV with a dedicated AT. Tauscan is a good (and easy to use) option. There are also a few freebie AT's available. They're good, but not as effective as the "pay-for" versions. If you want the best AT, go for BOClean. It's an excellent product but, alas, there is no trial verion available.

See this thread. Are you sure that this was a legitimate MS site?

 

Brett, I thank you too for your input. I used the MSUpdate option in Windows and found the new patch for MSOffice on the MSUpdate page. I did not receive the patch info in an email.

I just purchased BOClean, and hopefully with that program, and NortonAV I will be in a safer mode. Also, I have begun "pulling the cable plug" when not using the internet.

Orchided

 

Strange. See here. Every article I've read states that this particular nasty is propogated in this manner.

If you're sure that your machine wasn't infected in this way (and that it was infected via Windows Update) then maybe you should send a note to MS.

 

Brett, I accept your advice, and I have just transmitted an email to MS.

orchided ( http://home.satx.rr.com/orchided )