TrojanDownloader:Win32/Renos.DU

On my Vista, Windows Defender alerted about a file download from P2P:

TrojanDownloader:Win32/Renos.DU

I removed manually, but Windows Defender goes on to ask to me to remove it.
Why?


Thanks in advance,

Massimo

Mhaxx wrote:

> On my Vista, Windows Defender alerted about a file download from P2P:
>
> TrojanDownloader:Win32/Renos.DU
>
> I removed manually, but Windows Defender goes on to ask to me to remove
> it. Why?

Possibly because your manual removal wasn't thorough enough and the system
is still infected.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

You can also check to see if there are targeted removal steps for your
malware here:
Bleeping Computer removal how-to's -
http://www.bleepingcomputer.com/forums/forum55.html
Or here: Malwarebytes malware removal guides - http://tinyurl.com/5xrpft

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

On Tue, 20 Jan 2009 10:26:39 +0100, Mhaxx wrote:

> On my Vista, Windows Defender alerted about a file download from P2P:
>
> TrojanDownloader:Win32/Renos.DU
>
> I removed manually, but Windows Defender goes on to ask to me to remove it.
> Why?
>
Provided you have updated the in-build Malicious Removal Tool, it should
remove this particular malware. Why don't you run it?

>> I removed manually, but Windows Defender goes on to ask to me to remove it.
>> Why?
>>
>Provided you have updated the in-build Malicious Removal Tool, it should
>remove this particular malware. Why don't you run it?

Are you referring to Windows Defender?

I've just run and now it seems there's no risk. I don't know why.. do
you think I'm free of malware?

Massimo

From: "Mhaxx" <mhaxx@despammed.com>

>>> I removed manually, but Windows Defender goes on to ask to me to remove it.
>>> Why?

>>Provided you have updated the in-build Malicious Removal Tool, it should
>>remove this particular malware. Why don't you run it?

| Are you referring to Windows Defender?

| I've just run and now it seems there's no risk. I don't know why.. do
| you think I'm free of malware?

| Massimo

No it is NOT Windows Defender !

Dopwnload and execute the MRT manually.
http://www.microsoft.com/security/ma...e/default.mspx

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

> http://www.elephantboycomputers.com/...moving_Malware

Ok, the only thing I can't understand of it is the section:

"D. Recap of what you will need to have on-hand before you start the cleanup
process"

that if: have I to launch LSPFix to fix Internet connection problem if there
isn't problem?

It's true that when malware occured Internet connection through my router
seemed to be broken, but turning on the router everything now seems to work
good. So: have I to perform LSPFix?

Massimo

Mhaxx wrote:

>> http://www.elephantboycomputers.com/...moving_Malware
>
> Ok, the only thing I can't understand of it is the section:
>
> "D. Recap of what you will need to have on-hand before you start the
> cleanup process"
>
> that if: have I to launch LSPFix to fix Internet connection problem if
> there isn't problem?
>
> It's true that when malware occured Internet connection through my router
> seemed to be broken, but turning on the router everything now seems to
> work good. So: have I to perform LSPFix?

No. LSPFix is only if you can't get online. The concept of having it ahead
of time is in case you aren't able to get online to download it after
cleaning.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ