My computer have the trojan-downloader-terula

Viruses and worms
1

I has scanned my PC with Avast! and it find nothing. But other Anti-Spyware software find this trojan-downloader-terula at file C:\WINDOWS\system32\winbrume.dll, with a Very Hight Risk. Then I has move the file to a Quarantine folder (manually, because the software was a demo version) and then boot my PC to see if it don’t crash. When it was Up again, i look in the Window’s Registry, end I find that it was an ActiveX. Then I delete the references.

Now the big question is, Why don’t Avast! detect it first?, isn’t this Trojan in his Database?

2

http://www.sophos.com/virusinfo/analyses/trojdroppergf.html

No AV has 100% detection of all malware: the best advice is to use avast! in conjunction with a good anti-Trojan program, and a couple of good anti-spyware programs.

Ewido (XP’Win2000 only) http://www.ewido.net/en/

 and/or a-Squared [url]http://www.emsisoft.com/en/[/url]

Ad-Aware: http://www.lavasoft.de/

Spybot Search & Destroy: http://www.safer-networking.org/

3

If you are not getting a virus warning that you believe is a new, undetected virus, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest. This will hopefully be added to avast’s VPS file and help other avast users.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a either a new, undetected virus or false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

4

Hi theFenix,

Dangerous %SysDir%\winbrume.dll - Dangerous
%sysdir%\winbrume.dll
%SysDir%\winbrume.dll is Trojan/Backdoor.
Kill the file winbrume.dll and remove winbrume.dll from Windows startup, see the info FwF provided here:
http://www.sophos.com/virusinfo/analyses/trojdroppergf.html
Allthough, we did not get any feedback from you if it was cleansed?

polonus

5

At first place, thanks a lot for your help.

I don’t respond before because i haven’t internet access, my intention was really know how to send the report or file, so thanks a lot DavidR.

I not totally cleaned the Trojan, but it isn’t active in the computer now (it keep in some other files that a must to remove).

I will send the virus file to Avast! follow the intructions so we all can be protected in the future.

Again Thanks a lot for all your help.

6

Glad we could help, welcome to the forums.