Solved

Trojan Horse Infection

Posted on 2002-07-29
9
643 Views
Last Modified: 2013-12-28
I'm running Win98SE and Norton Antivirus tells me that windows\system\wnmngm1.exe is infected with a Trojan Horse, but is unable to repair the situation.
How do I proceed?
0
Comment
Question by:davereynolds
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
  • 2
  • +1
9 Comments
 
LVL 63

Expert Comment

by:SysExpert
ID: 7185927
I would rename the file, ( use *.old ) and see if it affects anything.

Other option is to do a
start-run - sfc
and have if replace that particular file ( if it is a system file at all ).

If not, then simply delete it since it is not needed.

I hope this helps !
0
 
LVL 12

Expert Comment

by:guidway
ID: 7186068
Try running this free virus scanner on your computer and see if it helps.

http://housecall.antivirus.com

Kind of like getting a second opinion. ;-)

guidway
0
 
LVL 12

Expert Comment

by:guidway
ID: 7186075
Strange, if that is a windows file there is no mention of it anywhere on the net (that I can find). Usually you can find a little info about any file on the net. This one isn't even listed.

guidway
0
Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

 
LVL 3

Author Comment

by:davereynolds
ID: 7186127
Explorer will not let me delete the file, and sfc says "You do not have permission to open this file- see the owner of the file or an admin to obtain permission".
Does this indicate it is a system file or just a virus payload? What's next?
0
 
LVL 12

Expert Comment

by:guidway
ID: 7186144
did you try running that other virus scanner on it? That would eliminate the idea of it being a virus if it doesn't detect anything.

guidway
0
 
LVL 12

Expert Comment

by:guidway
ID: 7186151
Does NAV say what virus it is infected with or does your computer do anything weird as a result of this problem?

guidway
0
 
LVL 4

Accepted Solution

by:
jpanderson earned 100 total points
ID: 7186424
Restart in safe mode (hit F8 repeatedly or hold down Ctrl button when starting.  Start > run > msconfig > startup tab > find any reference to the file being loaded and uncheck the box.  Restart again in safe mode and look in the win.ini file for any reference to this file being loaded and delete it.

Search registry: Start > run > regedit > delete any reference to the file.

Restart the computer and do another virus scan and see if its gone.

Please note:
Back up the file and any files that you modify, also back up the registry before you edit it.
0
 
LVL 4

Expert Comment

by:jpanderson
ID: 7186433
Forgot to mention that you should be able to delete the file now in safe mode.  If you can't just make note of where its located and then use a boot disk to start the computer and navigate to the file and delete it in dos mode. del wnmngm1.exe
0
 
LVL 3

Author Comment

by:davereynolds
ID: 7186557
Thanks JP. After deleting the regisry entry, Norton was able to delete the exe file and everything seems to be working well.
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question