Virus -- C:\Program Files\WindUpdates

[Empty_5oul]

i have recently run AVG and it has found 2 trojans in my c:.
the files are in C:\Program Files\WindUpdates - i have manually visited this folder and have 2 apps in there WinKa and WinUpdt. My comp says these are trogans but cant delete them, quarentine them or anything, also manually i cannot delete them as "access is denied" i am an admin.
Anyideas about the removal of these.
In avg the exact names of these 2 are:
Trojan Horse Downloader.Agent.2.S
Trojan Horse Downloader.Agent.2.T

[em99010pepe]

Try deleting those files using the DOS window.

[AMDave]

no results on the Antivirus sites. Appears to be a malware / spyware issue though.

here is a saga from someone else who has been having the same issue
http://forums.techguy.org/archive/index.php/t-248622.html
eeek!

But I did find this one where a solution appears to have happened...

"TUNEUP SHREDDER"
http://www.windowsbbs.com/showthread.php?postid=174239#poststop
---Extract Begins---
I tried to rename and alter the files contents as suggested on other forums but with no success. I rescanned with norton antivirus 2004 and accepted to delete files, but was not able to remove one of them, then I tried to delete it with TuneUP Shredder and was deleted immediatelyand also deleted the WinUpdate folder. I resacanned with norton and this time it found nothing, restarted the computer and it seems that I was succesful.
---Exrtract Ends---

GOOD LUCK !

--Dave--

[Empty_5oul]

excellent thx, i couldnt find any results on virus sites either :(.
i followed that link n it looks gd im currently downlloading Tune Up shredder which is what the other person used to solve their problem. if it works ill post again and if the softwares gd ill post the URL here

[Empty_5oul]

thx for that program, it is very good and freed up much space but didnt clear the viruses :(. I have just looked in taskmanager and they are also in there called - Win2ka and WinUpdt.

when looking for Win2ka i found this http://www.kuro5hin.org/story/2004/2/15/71552/7795 - as im running xp it wont apply as it looks like some code for 2000, but there are virus variants of this. AVG still says its there but wont do anythign to it, adaware and spybot obviously dont find it, trojan hunter and the program from "Moo soft" dont find it either.
i cant see what the viruses are doing and i still have full processor power, memory etc and nothings gone corrupt + i still have full bandwidth ??

[Ototero]

Try searching the registry for any entries..

They can be deleted there ok. If they occur in a RUN or RUNONCE entry, then great, just delete them.

If in doubt, rename the entries.

Should help.

[em99010pepe]

Try searching the registry for any entries..

They can be deleted there ok. If they occur in a RUN or RUNONCE entry, then great, just delete them.

If in doubt, rename the entries.

Should help.

I agree with Ototero.
Just delete everything unknow at this entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServices-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\run
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run-
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Runonce

[Keith75]

Would booting up in safe mode do any good?

[em99010pepe]

Or try these programs:

TDS-3 Trojan Defense Suite (http://tds.diamondcs.com.au/ )
RegRun Security Suite (http://www.greatis.com/)
Bazooka Adware and Spyware Scanner 1.12 (http://www.kephyr.com/spywarescanner/index.html)
SpywareBlaster 3.1 (http://www.javacoolsoftware.com/sbdownload.html )
SpyStopper 2.75 (http://www.itcompany.com/spystop.htm)
WinPatrol 7.0.0.3 (Plus) (http://www.winpatrol.com/)
Anti-Trojan Shield (http://www.atshield.com/)

[Empty_5oul]

thats for the advice, ill have a look in the registary but i tried some of those programs first n they seem to have destryoed it. it no longer runs and is not in task manager but the windUpdates folder is locked according to TDS and various other spyware, trojan removal and adaware tools.