Win32 Trojano 247 - infected, windupdate.comm.dll

You do NOT want that file !

Read here:

just go to Add Remove Programs and uninstall the Windupdates program - make sure you read the messages that pop up though... the last one is a trick one I think... if you click OK/Yes it wont uninstall! Cheeky buggars!

http://www.broadbandreports.com/forum/remark,10770083~mode=flat~start=20

Thx..I took your advice, but the problems was still there, eventually I had to delete all the Windows upgrades I got from the upgrade centre, and deleted the Windows Upgrades folder in Windows Explorer...seems to have done the trick...not sure if I sure go back to the Windows Upgrade centre now though...just out of interest, do you know what nasty little task that particular virus carries out?...

Cheers

Here it is:

W32/Rbot-FP is a worm for the Windows platform that also has backdoor Trojan functionality, allowing unauthorised remote access to the infected computer via IRC channels while running in the background as a service process.
W32/Rbot-FP spreads to network shares with weak passwords and via network security exploits as a result of the backdoor Trojan element receiving the appropriate commands from a remote user.


Also make sure you have deleted these entries:

Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Machine=winupdt.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
Microsoft Update Machine=winupdt.exe
and delete them if they exist.
Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:
HKCU\[code number]\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft Update Machine=winupdt.exe
and delete it if it exists.

http://www.sophos.com/virusinfo/analyses/w32rbotfp.html