Announcement Banner

peatatoms

updated

18 years ago

P

peatatoms

9 Posts

0

3772

April 1st, 2009 16:00

cannot remove apparent trojan - keeps adding entries to registry

I am working on a Dell 2400 that was not ( until recently) updated or protected properly with firewalls / virus protection.

I tried the demo copy of Norton Antivirus and it had detected I believe:
trojan.fakeavalert and another that was either trojan.vundo or trojan virtumundo ( I forgot the name)

I recently de-installed NAV installed the following:

ZoneAlarm Internet Security ( and is all up to date )
Adaware 2008 - free version ( and it too is up to date )

Both ZoneAlarm & AdAware run fairly clean with the exception of the cookies, etc ( low priority stuff)

My problem at this time is that there is something that is adding entries to the registry ( even when in safe mode) , and it causes numerous web pages to pop up when running IE7 or FireFox. 
The entries I find in the registry are :
\HKLM\software\microsoft\windws\currentversion\run
rundll32.exe "c:\windows\system32\rulufutu.dll",a
rundll32.exe "c:\windows\system32\piyudijo.dll",a
rundll32.exe "c:\windows\system32\kitehuvu.dll",a

When I delet these entries ( even in safe mode) they are added back in a few seconds.