[lukehorse]

Operating system: Windows 98

I found the Trojan.Win32.FTP Attack spyware on my computer yesterday using the X-cleaner antispyware. I was prompted to delete it, but after many attempts that has not happened. I have also tried to use my Ad-ware SE Plus and McAfee Guardian/V-shield but neither of these has worked. I then tried to delete it manually but I haven't been able to figure that out either. I've already backed up my registry but I got stumped at the next step. The directions I got came from the eTrust Spyware Encyclopedia.

It says to kill the following programs first:
ewayclient.exe
ewayserver.exe
remind_xp.exe
systemroot+\system32\drwatsom.exe
systemroot+\system32\wscan.exe

A problem here is that I only find one of these (remind_xp.exe) running. I did kill that one. The next step is to delete the registry key:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\reminder

The odd thing here is that I can't find this key in my registry. I guess my questions are these: 1. If that key isn't in the registry then why does the Trojan keep getting picked up by the X-cleaner? 2. Is this Trojan actually operating on my system somewhere or is there only a remenant of it that is getting picked up somehow? 3. If this Trojan is on my computer somewhere, can anybody give me some advise as to how to get rid of it?

Thanks for any help here and sorry about the long post.

[flavallee]

I don't know where X-Cleaner comes from, but someone else on this forum used it awhile back and it caused some major problems.

If you're concerned about spyware, you need to stick with the reliable and tested programs for it, such as Ad-Aware SE Personal 1.05 and Spybot - Search & Destroy 1.3.

Personally, I find McAfee to be problematic and a resource hog.

[polak]

You may want to try TrojanHunter, a well respected Trojan cleaner that works well getting rid of persistent trojans.

It has a 30 day free trial period. Update the program to the latest data base and use the "Full Scan" tab should you decide to use it.

http://www.misec.net/trojanhunter/