Hi Montey3,

After replacing yesterday AVG by Avast! pro, Avast found me that trojan while in its first boot scan. I run Windows XP Home Edition SP1.

The trojan files were:
1- C:\Windows\epkdcjqj.exe
2- C:\Windows\lklqbuj.exe
3- C:\Windows\srkvoh.exe

and another two, perhaps related to:
4- C:\Program Files\ClearSearch\Loader.exe
5- C:\Windows\System32\Clrschp052.exe

I RUN ‘regedit’ and searched the above file names
I found the files 1 to 4, only in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Note: from the place (on the left column) your cursor is, one needs to press (perhaps several times) the first letter of the next directory name to reach it.

I deleted the lines (on the right panel of the registery) of the above 4 files by right clicking on them and choose delete.

Then I let Avast to reboot my computer to scan again C:\Windows
To be on the safe side :slight_smile: I just moved them when asked even the 5th file since I had no trace of it in the registery.

When XP is running and I let Avast scan the memory, there was no trace of them.

I am rather a newbie in playing those games especially in altering the registery… So I search a lot before deciding to delete or rename anything :-\ I used to play with DOS ;D

Kerim