Trojan-gen.{VC} SETD.tmp , SET13.tmp

Viruses and worms
1 
I deleted Trojan-gen.{VC} SETD.tmp   yesterday and I deleted Trojan-gen.{VC}  SET13.tmp  tonight  , NZ .

I had downloaded FreeDownloader , something with a similar name , and I deleted them , all the programs that came with it yesterday , but they came back tonight .
I turned off System Restore both times , I had moved the Trojan to the Chest both times and Deleted the files from the Chest .
I removed the programs from the Add and Remove Programs .
I removed all the programs from Task Manager Processes tonight but not yesterday .
Do you think it will have gone yet ?

2

These are almost certainly adware/spyware and there are likely to be registry entries which could be responsible for there return.

  • What OS are you using? is it up to date?
  • What the filename, where was it found
    example (C:\windows\system32\infected-filename.xxx)?

If you haven’t already got this software, download, install, update and run it.

  1. Ad-Aware
  2. Spybot Search and Destroy
  3. Spywareblaster
  4. Download HijackThis.zip - also check out this HiJackThis Tutorial
3

hi , thankyou , I just read the help yourself notes
Windows XP Home Edition with all updates and XP2 applied .
Win32:Trojan-gen.{VIC} just {VC} in the Avast report , Field ID 5 was the first one I removed and the second one was all the same details but for , SET13.tmp Field ID6 .
I removed the Processes I found with my name beside them in the Task Manager just to be safe but I only found any unusual Tasks there the second time I removed it and its variation .
I may have removed all traces by now but if I haven’t I can get an idea what to do if any of it returns .
This has been the first time I’ve had a Trojan for 2 days .

I’ve only got Avast and Windows Firewall on .

4

I would suggest you get one of the freeware firewalls (discussed a number of times in the forums, Zone Alarm, Kerio, etc.) as XP’s firewall doesn’t protect you against outbound connections, so what is on your system can download more.

Run HiJackThis (ensure your browser is closed) again, this gives a good indication of what is running on your system and save the results, you can then us an on-line analysis tool.

For an on-line scan of your Hijackthis log file try here http://hijackthis.de/index.php
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1, if you need any help with any of the analysis let us know.

5

ive just cleared the ie cache because i couldnt connect to the I and now i can and i have found no more traces of the trojan yet