Win32:Adan-161 [Trj] - this trojan WILL NOT DELETE

I get 3 warnings about tis virus each night at around 8.40pm, and despite consigning it to deletion, or the chest, or recycle bin, it NEVER gets removed.

Any suggestions?

Does Avast! have plans to eradicate it?

Desparate for help, because it interupts my online gaming every jnight!

Thanks in advance.

Paul. >:(


Welcome to the forums, Paul. :slight_smile:

To be able to help you correctly, we need more information from you. What warnings are you getting? Can you give the exact text of the warning? Can you post a screen shot of the warning? Where is this virus found … file location, etc? What is your computer’s OS, any other av, other security programs, etc?


The Avast warning reads:

Virusa detected etc at:

c:\documents and settings\local\paul\ or the directory - this is maybe a bit mixeda round.

the syntax for the virus is: \ZangoTBinstaller.exe[upx]

It kicks in every night at 8.40pm and sets the alarm off 3 times.

I did send a report via the avast system as well.

The trojan wasn’t detected by Spybot Sewarch & Destroy. I also tried the Trend Housecall to see if that would find it but it wasn’t even acknowdeged at all !

Yet it remains…

I have tried to search my PC for the word “Zango” but nothing either.

That’s all I have.

Paul.

Here is a logfile from HijackThis:

Read.

Thanks.

Hi Paul,

You have MediaGateway:

C:\Program Files\MediaGateway\MediaGateway.exe
O4 - HKLM..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe

http://www.bleepingcomputer.com/startups/MediaGateway.exe-11299.html

I suggest you run Ewido: http://www.ewido.net/en/

Followed by these two programs in safe mode (tap F8 while booting):

Ad-Aware: http://www.lavasoft.de/

Spybot Search & Destroy: http://www.safer-networking.org/

Check with HijackThis! to make sure the two entries above have gone, and come back and tell us if they haven’t.

Touch wood they’ll be gone.

Good luck!

Used Ewido and it spotted this instantly and the I removed it with Hijack This from the registry (I think) and today, had no problems.

Thanks for advice guys.

Karma due. :slight_smile:

Bilbo.