Win32.trojanrunner.yab.200 trojan

Hi PhiloVance,

That trojan is in the Windows XP System Restore area, so it can not be cleaned up by the usual methods (such as telling your AV/AT to delete it, or deleting it directly yourself). You must cycle System Restore to have it empty out the contents safely.

Note that this will remove all the current restore points you have on your system, so, you won't be able to roll back your configuration until you have restarted System Restore and it has saved new restore points.

The procedure for why you need to do this and how to do it is documented pretty well here:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039

On the upside, if that is the only place this malware was found, then you may never have really been infected. System Restore could have just saved a copy of the original exe file that contained the trojan... One time when I was just testing with the eicar test virus, XP's System Restore saved a copy of it so that I kept getting alerts when I did full system scans. It was kind of funny, but, also educational in how this can happen.

Here's a local copy of the error message image you linked to (below).

Best Wishes,
LowWaterMark