[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question
[x]
Attachment Details

How to Remove Trojan.Wincod - if that's what it is?

Asked by TheClicker in Latest Threats

Tags: Wincod, wincodecpro

My boss, who lives in a different state, has contracted what I believe to be the Trojan.Wincod virus, but we can't remove it.

Symptoms include messages stating "Fatal Error:  Windows can't play the following media formats" and "Windows detected a fatal error in your media system" and "The media system on your computer is corrupt."  It also changed his wallpaper to a message saying All media systems on your computer have been crashed - his icons are different, and the start button is twice it's normal size.

Searching Symantec for these symptonms shows the virus to be wincod, but the removal instructions simply didn't work.  We've updated virus definitions, ran full system scans in safe mode and with him logged on, and searched the registry for the offending entries in both modes.  Nothing is there.  He should have a folder in C:/Program Files called GenericMultiMedia - it does not exist either.  He cannot bring up taskmgr.exe at all - not from CTRL ALT DEL or CTRL SHIFT ESC or Start-> Run -> taskmgr.exe.

I'm at a complete loss - I've googled the error messages and all I find are companies pretending to have removal instructions, but all include the purchase of a spyware program.  He already has two - Spybot and Adaware - and neither of them have found anything either.

Any ideas??
 
Related Solutions
 
Loading Advertisement...
 
[+][-]10/14/09 01:24 PM, ID: 25574746Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10/14/09 01:34 PM, ID: 25574859Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10/14/09 02:25 PM, ID: 25575444Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10/14/09 02:29 PM, ID: 25575477Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]10/17/09 05:35 AM, ID: 25595760Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10/20/09 10:48 AM, ID: 25616625Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091118-EE-VQP-93 - Hierarchy / EE_QW_3_20080625