Winstall.exe - helpp!!

[alisaselez]

Hi
My computer was infected with a trojan virus today, from a link from someone on msn messenger. I ran AVG Free and the virus went to the vault, which i have deleted and all seems to be running fine now. however, i've had to vault it three times. when I restart, the virus seems to reappear. but my computer is running fine.

but...

there is an icon on my desktop titled winstall.exe which when scanned doesn't contain a virus, but I have just had a quick scan thru some stuff on the internet and get the idea that its a nasty little program that lets other nasty stuff infect my computer I can't delete it, and in fact, am not sure if this is accurate and am a little worried its an important windows file i shouldnt be deleting at all.

I've now installed Avira Antivir as well, as a double up safety precaution, but no spyware detection programs as yet (I'm not even sure if I'm wording that correctly..)

help??
Lots of thanks

[admin_mvu]

Wow. Anything that says .exe installed that cannot be deleted would scare me. Especially, if it's a known virus.

Many times, the reason why you cannot delete the file is because it's currently being used. What you would have to do is to find the entry in your registry (I don't know the location but usually if it's a well known virus, there is a posting somewhere that tells you how to get rid of it) and delete the registry so that when you restart your window, it won't get loaded. Then, you can delete the file.

There is a difference between Anti Virus program and Anti Spyware program. For Spyware, there are two free ones that works pretty well.

Spybot Search and Destroy
Lavasoft's Ad-Aware

[mcnerd]

Sounds like your "winstall.exe" icon on your desktop is a pointer file and not the exe file itself. Pointer (batch) files would not trigger a virus warning.

[ClwTL]

I would go into msconfig and disable all start up programs. I mentioned it with the guy having slow internet explorer so i'm not going to write it all out again but its posted in is part of the forum already. the file is probably auto loaded to start with your computer so you can't delete it because it's a running program. by disabling all startup programs you can boot your computer on with it not running and run antivirus again and try to delete it and it should work