Trojan.Prova - Removal

Risk Level 1: Very Low

Printer Friendly Page

Discovered: May 1, 2002

Updated: February 13, 2007 11:39:01 AM

Type: Trojan Horse

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

Do the following to remove Trojan.Prova:

Run NAV, and delete all files that are detected as Trojan.Prova.
Search for and remove all copies of Sistrai.exe, and then delete all other associated files.
Remove the values that the Trojan added to the registry.

To remove files that are detected as Trojan.Prova:

Obtain the most recent virus definitions. There are two ways to do this:
- Run LiveUpdate. LiveUpdate is the easiest way to obtain virus definitions. These virus definitions have undergone full quality assurance testing by Symantec Security Response and are posted to the LiveUpdate servers one time each week (usually Wednesdays) unless there is a major virus outbreak. To determine whether definitions for this threat are available by LiveUpdate, look at the Virus Definitions (LiveUpdate) line at the top of this write-up.
- Download the definitions using the Intelligent Updater. Intelligent Updater virus definitions have undergone full quality assurance testing by Symantec Security Response. They are posted on U.S. business days (Monday through Friday). They must be downloaded from the Symantec Security Response Web site and installed manually. To determine whether definitions for this threat are available by the Intelligent Updater, look at the Virus Definitions (Intelligent Updater) line at the top of this write-up.
  
  Intelligent Updater virus definitions are available here. For detailed instructions on how to download and install the Intelligent Updater virus definitions from the Symantec Security Response Web site, click here.
Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
Run a full system scan.
Delete all files that are detected as Trojan.Prova.

NOTE: If C:\Autoexec.bat file is detected, delete it and rename C:\Autoexec.bac to C:\Autoexec.bat.
Use Windows Explorer to search for and delete all instances of Sistrai.exe. The file will be 30,208 bytes in size.

NOTE: Sistrai.exe is a legitimate utility that shuts down the computer. Because it is a legitimate program, NAV does not detect it. However, since the utility is dropped on the computer by the Trojan you may delete it.
Search for and delete all occurrences of the following files:
- Autoexe.bat
- Pl.dll
- Sistray.reg
- Sistray.bat
If you are running Windows 98/Me, then navigate to the C:\Windows\System folder and rename System12.sys to Msconfig.exe.

To edit the registry:

Click Start, and click Run. The Run dialog box appears.
Type regedit and then click OK. The Registry Editor opens.
Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\Run
In the right pane, delete the following values:

sistray c:\windows\command\sistray.exe sistrai.exe c:\windows\command\sistrai.exe
Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows\CurrentVersion\RunOnce
In the right pane, delete the following values:

sistray c:\windows\command\sistray.exe sistrai.exe c:\windows\command\sistrai.exe
Click Registry, and click Exit.

NOTE: The following steps apply only to Windows 95/98/Me.

To restore Regedit.exe and the Run option on the Windows Start menu:

Click Start, point to Programs, point to Accessories, and then click Notepad.
Copy the following text and paste it into the Notepad window.

REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Policies\System] "DisableRegistryTools"=dword:00000000 [HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Policies\Explorer] "NoRun"=dword:00000000
Click File, and click Save. Save the file to the Desktop as Fix.reg.
Exit Notepad.
Locate and double-click the Fix.reg icon on the desktop to import the changes into the registry.
When you are prompted, click Yes, and then click OK.
Restart the computer.

Writeup By: Gor Nazaryan

Technical Details

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}