-=PCTechTalk=- Re: about windows update

On 9 Jun 2005 at 21:12, Barb wrote:
> when I was installing a couple of updates from the windows update site
> just now I got a warning from Norton that it discovered THIS   Source:
> C:\windows\system32\kcppqh.exe it called it a trojan horse now I don't
> know what to do?

A trojan horse (typically shortened to "trojan"), is, as the name 
suggests, a small program which is used to gain entry to your 
computer. It should be treated as a virus; you should quarantine and 
remove it on first encountering it. You can do this in Norton's 
"Reports" section, if the file was automatically quarantined. If so, 
it will probably be sitting in your backed-up items. Just highlight 
and delete it.

If it was not automatically quarantined, run a quick Norton scan in 
the windows\system32 folder.

The important thing in identifying a program like this is the name of 
the infection; not the actual file name. The actual file name has 
probably been random-generated with junk characters.
You can find out the name of the infection in Norton's "Reports" 
section, then type it into the Symantec website for full, step-by-
step details on what the infection does, and how to remove it.

You should also update all your protection software, then reboot into 
safe mode and run full antivirus and antispyware scans on your system 
ASAP.



 
> one the downloads was a malicious spyware removal thingy
> could it have caused this??

Could you rephrase and explain in more depth, please? If you're 
talking about Microsoft's Malicious Software Removal Tool, that's a 
legitimate program that you can safely have on your machine. You will 
most likely NOT have received your trojan from windowsupdate.com; 
malware usually comes via e-mail, or through an open port used by 
P2P/chat programs. They can also come from bad CD-ROMs/DVDs. It 
depends on the infection, and you'll find out more from symantec.com.

Faustus



--
<Please delete this line and everything below.>

To unsub or change your email settings:
http://www.freelists.org/webpage/pctechtalk

To access our Archives:
http://groups.yahoo.com/group/PCTechTalk/messages/
http://www.freelists.org/archives/pctechtalk/

Other related posts: