Winstall.exe - helpp!!

[alisaselez]

Hi Hallo
My computer was infected with a trojan virus today, from a link from someone on msn messenger. I ran AVG Free and the virus went to the vault, which i have deleted and all seems to be running fine now. however, i've had to vault it three times. when I restart, the virus seems to reappear. but my computer is running fine.

but...

there is an icon on my desktop titled winstall.exe which when scanned doesn't contain a virus, but I have just had a quick scan thru some stuff on the internet and get the idea that its a nasty little program that lets other nasty stuff infect my computer I can't delete it, and in fact, am not sure if this is accurate and am a little worried its an important windows file i shouldnt be deleting at all.

I've now installed Avira Antivir as well, as a double up safety precaution, but no spyware detection programs as yet (I'm not even sure if I'm wording that correctly..)

help??
Thanks a lot

[BinaryBoy]

Don't know if this will help but... try looking in these registry keys for the suspicious program. Apps listed there will run when Windows boots.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce

You could also try moving and renaming the file instead of deleting it. If it causes problems, you could reboot in safe mode and copy it back.

By the way, if you have PalTalk, you could try going to the PCTech room for help. They're really good at solving problems like this and its free. Just make sure you raise your hand before you ask a question. They're picky about that.