Issue Dealing With A Detected Win32/Pinit

[peterdevlin]

I'm a new NOD32 Business user (60 seats) and I've just found an AV issue within a few hours of installing. The problem is summarised below:

{QUOTE-> Column Name Value
Column Name Value
Threat Id Threat 14
Client Name Custard
Computer Name Custard
MAC Address 001143d2b176
Primary Server Dangermouse
Date Received 2009-05-05 15:31:08
Date Occurred 2009-05-05 15:26:18
Level Critical Warning
Scanner Real-time file system protection
Object file
Name C:\windows\system32\user32.dll
Threat Win32/Pinit virus
Action
User NT AUTHORITY\SYSTEM
Information Event occurred during an attempt to access the file by the application: \??\C:\WINDOWS\system32\winlogon.exe.
Details Ready

<-QUOTE}

I have made multiple scan and remove attempts with NOD32 and even MalwareBytes' Anti Malware. No luck removing (and the latter won't even detect it). It appears as though NOD32 cannot deal with this file.

As this is a live production server I have limited options for taking the server down.

Could this be a false positive? Any recommendations as to next steps?

[Toby75]

Most likely a FP. AVG had the same issue back in Nov.
http://www.tomshardware.com/news/avg-antivirus-virus-removal,6587.html

[Marcos]

{QUOTE-> Most likely a FP. <-QUOTE}

Highly unlikely. I'm affraid you won't avoid booting to safe mode and replacing the file with a clean copy. You can also try using the system tool sfc.exe to check system files for consistency.

[Toby75]

I would still do my due diligence before deleting or making any changes.

[SmackyTheFrog]

If it is launching with the winlogon process, then the trojan should only be active when a user is logged in unless it also hooked in to processes running with system credentials. Try logging out and replacing the user32.dll file with a non-trojaned one from another machine using the administrative share \\custard\c$\ as that may get the malicious code out of memory and clear out the file locks. If it is hooked in to other processes, you could try using process explorer to view the active threads in those processes and killing off the ones that shouldn't be hooked there, but this can be risky and cause processes to crash.