Help remove win32/Wigon Trojan

[bdmc]

Hi All,

I have just been handed a PC that didn't have anti-virus installed. I have just installed NOD32, and it has found a few files infected with win32/wigon trojan.

It was able to remove some of the infected files, but 1 file is unable to be removed.

c:\windows\system32\drivers\Tah20.sys

In safemode, I am still unable to rename or delete this file.

Under HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal, there is a key for Tah20.sys, which I am unable to delete from the registry. So the driver is starting up even in safemode.

For some reason my BartPE boot disk isn't able to see the harddisk.. Encryption is turned off though...

Anyone have any ideas?

[nonoise]

use superantispyware home

[Kosak]

Hello,

try to use Avenger (http://swandog46.geekstogo.com/avenger.exe) with this script:

Drivers to delete:
Tah20

Files to delete:
c:\windows\system32\drivers\Tah20.sys


Regards