Trojan Horse C:\Windows\System32\****.exe

I have a friend with Windows XP, she has let her two grandchildren open up
AOL and one of them infecting the computer with a Trojan horse. The machine
has Norton antivirus and Ad-Aware antispyware. I unpluged the dial up from
the wall. Ran the AD-Aware and Norton and found a replicating Trojan which
could not be entirely deleted. I ran a system restore and the boys profile
which had melting buttons and wierd colors returned to normal. The machine
has 3 profiles. After rehooking up the dial up connection the Trojan popped
up again. I ran defrag and disk clean up and also deleted cookies and
histories from the three profiles. Her machine is starting up, allowing her
to log in and then instantly rebooting. Norton warnings come up with
slightly different file names for the Trojan horse. Is there a patch for
this trojan that I can download to my machine and with hers disconnected
install to kill the Trojan? Or is it time to 0 out the hard disk and
reinstall everything?

This wouldn't be a Windows Update issue, but I would suggest you check out
the security information at www.aumha.org/secure.htm (Microsoft MVP Jim
Eshelman is the site host) where you can find a good variety of free
programs to check for malware/spyware/Trojans and the like. He's also got a
very active security forum. If Norton is showing you the name of the
Trojan, their web site should have information on how to remove it.
--
Chris H.
Microsoft Windows MVP/Tablet PC
Tablet Creations - http://nicecreations.us/
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone


"Raichbarrtaigh" <> wrote in message
news:FA441335-03A2-435E-9277-...
>I have a friend with Windows XP, she has let her two grandchildren open up
> AOL and one of them infecting the computer with a Trojan horse. The
> machine
> has Norton antivirus and Ad-Aware antispyware. I unpluged the dial up
> from
> the wall. Ran the AD-Aware and Norton and found a replicating Trojan
> which
> could not be entirely deleted. I ran a system restore and the boys
> profile
> which had melting buttons and wierd colors returned to normal. The
> machine
> has 3 profiles. After rehooking up the dial up connection the Trojan
> popped
> up again. I ran defrag and disk clean up and also deleted cookies and
> histories from the three profiles. Her machine is starting up, allowing
> her
> to log in and then instantly rebooting. Norton warnings come up with
> slightly different file names for the Trojan horse. Is there a patch for
> this trojan that I can download to my machine and with hers disconnected
> install to kill the Trojan? Or is it time to 0 out the hard disk and
> reinstall everything?