win32:Walivun[trj]

Viruses and worms
1

Hi

Ive had a call from someone inexperienced with laptops 70 miles away saying that earlier today avast alerted them to a trojan. Then a window popped up saying to install antispyware software. she said she selected to run it. avast has alerted her to multiple trojans and ever since she has been unable to acces the net via internet explorer, msn messenger etc. The icon bottom right displays like connected but she has been unable to access the net in anyway.

I have established that she has 4 trojans named win32:Walivun[trj] quarantined in her avast chest from the day and time of the attack.
Ive had her schedule a boot Time Scan. And ive had her run windows defender. And lastly to disable windows firewall to see if it was a firewall issue. Still no access to the net despite the connected icon being present.

With her not having any access to the net and me being 70 miles away our hands are a bit tied.

Can anyone help ?

Does anyone know of a removal tool that maybe i can download and send to her by post for her to run ? Anything like that will be greatly appreciated.

cheers

2
Does anyone know of a removal tool that maybe i can download and send to her by post for her to run
You mean burn on a cd and send?
Then a window popped up saying to install antispyware software. she said she selected to run it.
Looks like she have downloaded a rogue security program....... :P
3

yes burn to a cd and send

4

MBAM http://filehippo.com/download_malwarebytes_anti_malware/ the best rogue remover
SAS http://filehippo.com/download_superantispyware/
Norman Malware Cleaner http://www.norman.com/support/support_tools/58732/en
Dr.Web CureIt! http://www.freedrweb.com/cureit/?lng=en
Dr.Web LiveCD http://www.freedrweb.com/livecd/?lng=en
How does it work? http://www.freedrweb.com/livecd/how_it_works/

MBAM and SAS need internet to get the latest updates
NMC and Dr.web are fully updatet when downloaded (updatet on the web daily)

5

Hi redspark,

Win32:Walivun has been detected in these files:

If you have the following files on your system with the corresponding md5’s you are most likely infected. You can remove Win32:Walivun by deleting the files.
Important Note: If you are not 100% sure of how to check md5 signatures or is it a critical system file you should not delete it yourself, it would be better to use an antivirus program. You can click here to run a free virus scan

Filename MD5
load.exe 1125be28104920606642555277f5a4e9
malware.exe e6ec1b17273f79d73c91f99c2f4c55e5

also see: http://www.pc1news.com/virus/alias-trojan-win32-fakespypro-ik-139801.html
also discussed here:
http://forum.avast.com/index.php?topic=45701.0

polonus