Trojan.bookmarker.gen

[rkl69]

Help! I have tried EVERYTRHING to try and get rid of Trojan.bookmarker.gen but it keeps manifesting itself!! Any ideas would be greatly appreciated.
Thanks

[DaveSW]

Have you tried ADaware: http://lavasoft.element5.com/software/adaware/
Spybot S&D: http://www.safer-networking.org/en/download/index.html
And updated your antivirus?

Also if you're running antivirus you may need to run it in safe mode, and disable system restore.

[dlh6213]

Try this thread:

http://www.daniweb.com/techtalkforums/showthread.php?t=8508

It took awhile, but finally got it cleared up! Follow the steps I did, including posting HJT logs because you may have more problems than you are aware of.

[rkl69]

Hi, yes, I have both Spybot and adware...run both with no luck so far....I have HJT....which I have run numerous times, but I am not sure if I am missing something in the registry? Also, this virus keeps creating new file names....2 this morning so far:
C:\WINDOWS\SYSTEM32\npil.dll
C:\WINDOWS\SYSTEM32\klnkn.dll

Any ideas would be hugely appreciated.
Thanks,

Have you tried ADaware: http://lavasoft.element5.com/software/adaware/
Spybot S&D: http://www.safer-networking.org/en/download/index.html
And updated your antivirus?

Also if you're running antivirus you may need to run it in safe mode, and disable system restore.

[dlh6213]

Go to the thread I gave you before and look towards the end for instructions on using reglite. It should make theses dll's visible so you can delete them.

[rkl69]

Go to the thread I gave you before and look towards the end for instructions on using reglite. It should make theses dll's visible so you can delete them.

Thanks, just to clarify...I am not runnung Windows NT, but XP Pro....do I still follow the same steps? When I follow your steps as per the link you sent me, I see the culprip file in reglite as:
C:\WINDOWS\system32\ms.dll

I just want to be sure I delete the correct file and not something that is a system file.
Thanks......

[DaveSW]

if you google that file you'll find it's a backdoor trojan, so yes delete it... ;)

[dlh6213]

Thanks, just to clarify...I am not runnung Windows NT, but XP Pro....do I still follow the same steps? When I follow your steps as per the link you sent me, I see the culprip file in reglite as:
C:\WINDOWS\system32\ms.dll

I just want to be sure I delete the correct file and not something that is a system file.
Thanks......

I was running XP Home on the computer I had the problem with, but I don't think the OS really matters (as long as it's windows). After you delete the ms.dll, post a HJT log so the senior techs can review it and hopefully mark this thread as solved!