Jean-Marie said:
I use XP SP2. Since 2 weeks an icon called "carrylaunch" appears on my
desktop. "Search" shows a program carrylaunch.exe resides in System 32.
Can you tell me what this program does ? Has it always been there ? If not
how could it get there. I have Norton Internet security suite since years end
never something passed thru the firewall.
Your machine infected with Trojan.Vundo or Zlop variant.
Access your Add/Remove and uninstall the program if it is listed there, if
not then you will need to delete it manually from windows explorer.
Go through these Cleaning steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start >> Control Panel >> Double click Network and Internet
Connections >> Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from here:
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
Run a scan from here on-line:
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from here:
http://www.avast.com/eng/avast-virus-cleaner.html
Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com
download Hijackthis and send me the log.
(
http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php)
Send me copy to my address is : to_you_ross(at remove this and repalce with
the
obvious)yahoo.co.uk
( _ is underscore)
HTH
nass