PC Hell: Grum Trojan Removal Instructions

How to Remove Grum Trojan Program

What is the Win32.Grum.a Trojan?

An email disguised as a Internet Explorer download from admin@microsoft.com contains a Trojan downloader that infects the computer with a virus named Win32.Grum.

Hijackthis shows the trojan horse adds the following information or similar lines to the Windows registry

O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\User\LOCALS~1\Temp\winlogon.exe

The infected file is stored in the Temp directory under Local Settings for the logged in User, and is autostarted in the following registry locations:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

How Can I Remove the Grum Trojan from my system?

1) Disable System Restore

2) Restart in Safe Mode

3) Once in Safe mode, click on Start, Run

4) Type REGEDIT and press Enter

5) Navigate to the appropriate registry section by clicking on the plus signs (+) next to

HKEY_LOCAL_MACHINE
Software
Microsoft
Windows
CurrentVersion
Run

6) Right-click and delete the following entry in the right-hand side

Firewall auto setup = %User Temp%\winlogon.exe"

%UserTemp% is the Temp folder usually in the following location
c:\Documents and Settings\{user name}\Local Settings\Temp

7) Repeat Step 5-6 above for the following location as well

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

8) Close the Registry Editor

9) Restart the computer in Normal Mode

9) Scan your computer with online virus scanner like Housecall, BitDefender, or eTrust or download and install an antivirus program and run a complete scan. A list of online scanners is below, some however will only scan but not remove issues.

10) Open My Computer, Right-click on Drive C, click on Properties, and click Disk Cleanup to delete other temp files

11) Turn System Restore Backup on

Online Virus Checkers
Trend Micro Housecall - will scan and remove threats
BitDefender Scan Online - will scan and remove threats
Ewido Online Scanner - will scan and remove threats
Kaspersky Online Scan - will scan and remove threats
Panda Activescan - appears to only scan for but not remove threats
McAfee FreeScan - appears to only scan for but not remove threats
eTrust Antivirus Web Scanner - will scan and remove threats
Symantec Security Check - will scan and remove threats
Dr.Web Online Check - user can upload and test for threats on particular files