can i delete?

[TOONEW]

i ran my scan and i got these two alarms but im not sure if i can delete them??
Scan Control Dumped @ 21:03:11 04-09-03
RegVal Trace: RAT.Imiserv: HKEY_LOCAL_MACHINE
File: Software\Microsoft\Windows\CurrentVersion\Run [Win Server=C:\WINDOWS\winserv.exe]

RegVal Trace: RAT.Imiserv: HKEY_LOCAL_MACHINE
File: Software\Microsoft\Windows\CurrentVersion\Run [Win Server Updt=C:\WINDOWS\wupdt.exe]

any and all help is appreciated.Thanks...

[DolfTraanberg]

Hi TOONEW and welcome

yes you should delete those registry entries but you should search for the files as well. Have a look here:
http://www.sophos.com/virusinfo/analyses/trojimiserv.html
After you have done this restart your system and scan again to look if they have really gone.
Dolf

[Jooske]

Hi TOONEW and welcome!

And if you're on XP or ME you should make a new restore point so they don't come back either.

[Pilli]

Welcome Toonew, If you can tell us a a little more about your system, OS, security software etc. there may be other recommendations that can help you secure your system.

[Gavin - DiamondCS]

If you still have the files wupdt.exe and winserv.exe email them to gavin@diamondcs.com.au for confirmation :) You should delete the registry entries immediately and reboot, if they are still there then make sure the EXE files are not running -

In TDS, go to System Analysis, Process List and find wupdt.exe or winserv.exe, right click, choose Kill Process

Then from the same menu, choose Autostart Explorer, ensure the 2 registry keys you noted are gone

Reboot, trojan essentially dead as it cant start itself ;D
Delete the files if detected in a file scan, please send them in for confirmation - or in case they are a new variant !