Trojan Del-457 Please help??? HOSTX.EXE

[teqmod]

Allright, here is what I did. Removed the following files:
WINNT/system/tunva.ini
WINNT/system/tunva.bak1
WINNT/system/tunva.bak2
WINNT/system/avnut.exe

I also did a search for and removed all instances of tunva.* hostx.* avnut.* & bkinst.*

next using regedit I removed the following keys (I recommend backing up your registry before doing this):

HKLM\software\classes\atl.events (there were 2 instances of this but atl.registrar is supposed to be there so leave it alone)

HKLM\software\microsoft\windows\currentversion\runonce avnut.exe
HKLM\software\microsoft\windows\currentversion\run avnut.exe

I also did a search in the registry for hostx, avnut & tunva and removed all the associated keys under CLSID

After the reboot it did not come back and everyone is happy.

Good Luck!

 

[KYR]

Unfortunately, I have none of those files you mentioned. I must have something else. Thanks for trying. Appreciate it.

 

[~mr mixx~]

Re: Trojan Del-457 Please help???

ok, did you boot-up to safe mode, and search for:"oledoc.exe".

delete, all above findings that have the name(oledoc.exe)

teqmod , is on the right track though....you must check your (run) & (run once) folders....they will be in the :HKEY_CURRENT_ USER & HKEY_LOCAL_MACHINE: this scan is a reg scan...

scan those to find the run & run once foder for the oledoc.exe, and delete it.

also in safe mode: check the start-up tab by going to
start/ run/ type "msconfig" without the quotes, then startup tab, and check to see if the (oledoc.exe) is there: if it is then uncheck the box for it.

 

[Flaxen]

You can find a guide on removing this here:

How to remove Virtumonde DEL-457 Host.exe malware

Hope this helps