Win32-Horst-C

Viruses and worms
1

My computer is infected by Win32-Horst-C. How can I remove it?

2

Hi michaelu,

How do you know you are infected?

Which program detected the Trojan and what was the filename and location?

If avast! detected it, have you tried a boot time scan?

Have you tried running the excellent anti-Trojan program Ewido?

http://www.ewido.net/en/

3

Win32:Horst-c is in the avast virus database, so when detected avast should have given you a number of options on the action to take (see image), what did you choose and what was the outcome ?

4

Hi michaelu,

Do as FwF said. Please download Ewido Security Suite at http://www.ewido.net/en/download/.

  1. Install Ewido Security Suite.
  2. When installing, under ‘Additional Options’ uncheck:
  • Install background guard
  • Install scan via context menu
  1. Launch Ewido, there should be an icon on your desktop, double click it.
  2. The program will now open to the main screen.
  3. When you run Ewido for the first time, you might get a warning ‘Database could not be found!’. Click OK. We will fix this in a moment.
  4. You will need to update Ewido to the latest definition files.
  • On the left hand side of the main screen click update.
  • Then click on start update.
  1. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display ‘Update successful’.
  2. Exit Ewido. DO NOT scan yet.

If you are having problems with the updater, you can go to http://www.ewido.net/en/download/updates/ to update manually.

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don’t work - http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Don’t run it yet.

Restart your computer and boot into Safe Mode (if you don’t know how, go to http://www.bleepingcomputer.com/forums/ind...showtutorial=61 ).

Run a scan in HijackThis. Check each of the following if they still exist and hit ‘Fix Checked’ after you check the last one:

O4 - HKLM..\Run: [.nvsvc] C:\WINDOWS\system\smss.exe /w
O23 - Service: Windows Log - Unknown owner - C:\WINDOWS\system32\nvsvcd.exe

Locate and delete the following:

C:\WINDOWS\system\smss.exe
C:\WINDOWS\system32\nvsvcd.exe

CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck ‘Scan local drives for temporary files’. Also uncheck those two Newsgroup entries if you don’t want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it’s done, choose Yes to logoff.

Run Ewido now:

  • Click on scanner and then Settings. Under ‘What to scan’ select ‘Scan every file’ and hit OK.
  • Click on ‘Complete System Scan’ and the scan will begin.
  • While the scan is in progress you will be prompted to clean the first infected file it finds. Choose ‘Remove’, then put a check next to ‘Perform action with all infections’ in the left corner of the box so you don’t have to sit and watch Ewido the whole time. Click OK.
  • Once the scan has completed, there will be a button located on the bottom of the screen named ‘Save report’.
  • Click ‘Save report’. Save it to your desktop.

Restart your computer to get back to Normal Mode. Post the Ewido report for FreewheelinFrank.

polonus