How to Deal with the New Trojan.Peacomm Virus

I was working on a client's computer a few days ago, and the trouble was this: his antivirus program kept alerting him about this virus, and reminding him that he was not protected against this particular threat. He had just installed a more recent version of the Norton Protection Suite, yet it could not remove this Trojan. His family would not use the computer, fearful of any further damage that may arise.

A little snooping around revealed it to be something called the Trojan.peacomm virus. This piece of malware is known to do two things: (1) it sneaks into your system usually via e-mail and (2) it drops in a small program into the registry and allows for a download of several other malware programs that do a nasty variety of things, from logging your keystrokes to hijacking your computer altogether. For more details, I shall include a couple of links that will share more of what Symantec / Norton knows about it so far.

I tried running a scan with the installed Norton, but was not able to eliminate it that way. Less than a minute after a restart, the warning was still popping up. Reaching into my old bag of tricks, I ran AdAware SE and ToniArts EZ Clean, which found and removed a lot of suspicious objects among the files and in the registry. Convinced it was gone, I restarted the system again. And less than a minute after restart...you guessed it..."You are still not protected against the following threat...Love, Norton"

The threat was not present on the system in any form, and to make sure I even downloaded and ran SpyBot Search and Destroy to track down anything my first attempts might have missed. The client's antivirus continued to insist the threat was not removed. I stayed at the client's location for a bit longer to make sure none of the Trojan.peacomm's component files were to be found anywhere on the drive. Fortunately, he is safe for now.

Things to consider for the future. These may already apply to you:

1) After questioning the client about his installed Norton, it turns out that he opted to purchase a later version rather than renewing his present license. As a result, not only did he manage to have two antivirus products competing with each other, neither one was updated sufficiently to deal with the threat.

2) What the antivirus program was telling us, therefore, was that it didn't have the capability of dealing with the threat, but it didn't mean the computer had the Trojan at that very moment. Pretty much a rationale for taking care of the expired license, for future protection.

3) What the client should have ideally done was to renew the license on the older protection software, and download all the updates. Right now he also has the option of keeping the new protection software, but has to uninstall the old one first.

For your general protection:

1) It is best to have at least Windows Personal Firewall on, or an alternate product. I prefer to couple this with another anti-malware utility.

2) Do not download unexpected e-mail attachments. This one of the fastest ways to spread a Trojan virus.

3) Another is peer-to-peer (P2P) sharing. Limewire and Kazaa are notorious for having unsuspecting users spreading malware rapidly by sharing files that they don't know have been infected. Use at least one of the utilities that help clean malware from your system.

4) These include, but are not limited to, AdAware SE, Spybot Search and Destroy, ToniArts EZ Clean, and others. These are completely free of charge and are regularly updated online, and all of them are highly recommended. I like to run at least one of them every time I visit a (P2P) site, and I chack to see if they have also removed the malware's component files. If not, I do that manually.

5) If you are already comfortable with editing the Windows Registry, one of the links below will mention which entries to remove. Otherwise, have a trained technician do this for you, as a single mistake can have serious consequences.

6) Keep your antivrus always updated. This will make sure your computer can protect itself against recent known threats.