Downloader Virus?

[DaTT]

My brother in-law run windows 98se and he called me tonight asking how to remove a "downloader virus"....I've never even heard of it. It was AVG virus scanning software that found it at boot up, but during a scan it does not detect it. The actual name it says it found is: Trojan Horse Downloader.crypter.c and it says its infected in his win/temp folder the file wnk9200.exe. There is no such file......just similar file names, but tmp files...not exe.

Can someone throw a dog a bone over here?

Thanx

 

[mechBgon]

If he doesn't have Show Hidden Files And Folders enabled, the file may be there but not visible to him. Have him go to that folder, then click Tools > Folder Options > View and have it show all files, then click the button to have it use that view for all folders. Now try to empty the contents of the whole Temp directory, update the virus signatures, ensure that it's set to use Heuristics, and click the "Save Parameters As New Default" button so it retains them.

Now right-click the AVG icon in the system tray, choose Run AVG Antivirus, and run the Complete Scan and see how that goes. I'd also have him install ZoneAlarm basic firewall software.

If you're still not sure if the system is clean, this might be a good excuse to nuke the whole thing, buy WinXP and another 128MB-256MB of RAM, burn ZoneAlarm's and AVG's installers to a CD in advance, and install WindowsXP (while the system's network and phone cables are physically unplugged, to keep worms out), then AVG and ZoneALarm, and then connect the cables and go to Windows Update for the necessary Critical Updates (go back several times until you've got them all).

 

[wnied]

Boot up in safe mode, then look for the file where its said to be, delete it and all will be well again.

Hope this does it for you.
~wnied~

 

[DaTT]

Anyone heard of this virus before?

 

[mechBgon]

Originally posted by: DaTT
Anyone heard of this virus before?

I tried looking it up at McAfee's virus library and Grisoft's too, but wasn't getting any results.

 

[OZEE]

plenty of info available if you google "downloader crypter"

manual removal info from pestpatrol


manual removal info from symantec Another name for the same trojan is Gema.

 

[DaTT]

Thank you.....I tried a search on symantec and found nothing. But thanx.