Copyright: Trojan Remover Help Version 6.5
Citation: Copyright © 1999-2004 Simply Super Software


Getting Help

Context-sensitive help is available in most entry fields. With the cursor placed in a text-entry box or in a control box pressing F1 will bring up specific help as required.

For general help select ‘Help | Contents…’ from the main menu, click on the Contents tab and choose the topic of interest. To search the help file either click on the Index tab or on the Find tab.


What Trojan Remover will do

Trojan Remover will examine all the system files, including the Windows Registry, and determine the programs and files that are loaded at boot time. The majority of Malware files (once active) are loaded this way.

Trojan Remover will attempt to identify the file in question. If it is a known system file required at start up a note will be placed in the logfile. If the name is identical to a known Malware filename, a warning will be issued.

For each identified Malware file, or unrecognised program or file, Trojan Remover will pop up a screen showing the file location and name, offer to remove its reference from the system files and allow you to rename the file if you request it.

Where a file called at boot time is found to exist on the system, the file will be scanned to see if it contains Malware. If one is found a warning will be displayed.

Trojan Remover will on request remove all the modifications carried out by those Malware files  which make system changes.

Most modern Malware files are activated as soon as Windows starts, thus making their renaming more difficult. Trojan Remover can, on request, reboot the system and rename these files before Windows restarts. When this option is chosen, the Windows system files are set to read-only to prevent re-infection. The read-only attribute is removed when Trojan Remover has restarted the system.

Trojan Remover will write information to the logfile each time a new Scan is activated. This logfile will contain detailed information on which system areas were checked, which programs/files are loaded at boot time, and what (if any) actions were taken. The logfile is viewable from the Main Menu.

See also:

Viewing/Printing Logfiles


Uninstalling Trojan Remover

To uninstall Trojan Remover, click on the START button in the Windows taskbar, then on Programs > Trojan Remover > Uninstall Trojan Remover.

Alternatively, select Settings > Control Panel. Double-click on Add/Remove Programs, highlight Trojan Remover Version x.x.x, and click the Add/Remove button.

If you have carried out any scans with Trojan Remover then a logfile will have been created in the directory to which Trojan Remover was installed. In this event this logfile and the main Trojan Remover directory may not be removed. If this is the case you should manually remove the logfile and the directory after running the Uninstall program.


Viewing/Printing Logfiles

When a scan has been completed, you have the option of viewing the logfile by clicking on the [image] button. When the log is shown, you can print it by clicking on the [image] button.

You can view and print the logfile by selecting the View Logfile… and Print Logfile… options in the File menu, or clicking the [image] and [image] buttons.

The Logfile is named TRLOG.TXT and is stored in the same folder to which the main Trojan Remover program was installed [C:\Program Files\Trojan Remover by default].

This logfile is automatically truncated by Trojan Remover when it reaches a certain size. Older information is removed first.


Starting A Scan

To start a scan of the computer for Malware, click on the [image] button on the opening Trojan Remover screen.

A box will pop up showing that the scan is taking place.

You can stop the scan at any time by clicking on the [image] button. After answering yes at the confirmation message, the scan is cancelled. This will not affect any actions already carried out by Trojan Remover.

When the scan has been completed, Trojan Remover will display the system areas that have been checked. To view the logfile showing scan information, click on [image]. To return to the opening Trojan Remover screen, click on [image].

If a program or file being loaded is either not recognised, or identified as a Known Malware Filename, an Alert box will be displayed requesting what action should be taken.

See also:

Alerts

Viewing/Printing Logfiles

Scanning A Drive or Directory


Updating the Known Malware Database
Updating the Known Malware Databases

Additions are made to the Malware Databases in-between releases of updated program versions of Trojan Remover. Click on the “Update” button on Trojan Remover’s main menubar to allow Trojan Remover to check online for updates. Alternatively you can select “Utilities > Check online for updates” from the main menu. You need to ensure that you are already connected to the Internet before using this option.

This will launch the Trojan Remover Updater which will check online to see if there are any updates available. If there are, the Updater will on request download and automatically install the updates.

Each time you run a Scan with Trojan Remover it checks the date of the database you are using. If this is older than 28 days a warning is displayed on the screen. You can turn this warning off by placing a check in the box labeled “Do not show this warning again”. If you later wish to re-enable this alert, select “Options” from the main Trojan Remover menu and click on “Re-enable out-of-date database warning”.

See also:

Updating Trojan Remover

Scheduling Automatic Update Checks


Updating Trojan Remover

You can check online for updates by clicking on the “Update” button in Trojan Remover’s main menu or by selecting “Utilities > Check online for updates” from the main menu. This will launch the Trojan Remover Updater. You need to ensure that you are already connected to the Internet before checking for updates. If you use a firewall then you will need to ensure that your firewall allows “Trojan Remover Updater” to access the Internet.

The Updater will first check online to see if there are any Program or Database updates available. If there are you will be offered the option to downloaded the update(s). Clicking on the Update button on the Updater screen starts the update. All files needed for the update are downloaded and automatically installed, and where necessary registry information is updated. Normally Trojan Remover can update itself without requiring a reboot, but if a reboot is necessary then you will be prompted, and the update will only be complete once you have rebooted.

If you have problems using, or do not wish to use, the integral Updater then you can check manually for new updates at the following address: http://www.simplysup.com/tremover/

To manually install an Update all you need to do is download and run the Update program from the ‘Updates’ page at the website.

See also:

Updating the Known Malware Database

Scheduling Automatic Update Checks


Alerts

If Trojan Remover finds a file or program it does not recognise being loaded by the system files or a Startup Group it pops up an Alert box (depending on the Alert Viewing Option chosen). The Alert will show the name and location of the called program and state whether an executable file with this name has been located in the path.

** Note **

If Trojan Remover is not able to locate the file this does not necessarily mean that it does not exist. Trojan Remover may have difficulty locating files on ancillary drives. If the location of the file is shown as being on a different drive to that from which Trojan Remover is run you should attempt to manually locate the file.

Trojan Remover will compare the name of the file to a database of known Malware files. Should the names match a warning will be displayed.

If the file exists, Trojan Remover will scan it to see if it contains Malware. If the file is suspect a warning will be displayed.

When a file is suspect the [image] button will be activated. Clicking on this button will open the Malware Reference Database and display details on the Malware.

Should the Malware be known to make system modifications and you elect to take action on it, Trojan Remover will offer to reset any changes made by the Malware.

See also:

Alert Viewing Options

System.Ini Alert Options

Win.Ini Alert Options

Registry Alert Options

Startup Group Alert Options


Win.Ini Alert Options

When Trojan Remover finds a file being loaded from a LOAD= or a RUN= line in the Win.Ini that it does not recognise it pops up an Alert box. The options available to you will depend on whether Trojan Remover is able to locate the referenced file. Select the required option by clicking on the appropriate radio button and then clicking on [image]:

If the file exists, Trojan Remover will scan it to see if it contains Malware. If the file is suspect a warning will be displayed. Clicking on the [image] button will open the Malware Reference Database and provide details on the Malware, if they are available.

If the file can be located, you will be presented with these options:

Continue to allow this program to load as normal

Selecting this option will make no changes - the program will continue to load at boot time (so long as it exists).

Prevent this program from running by commenting it out

Selecting this option will remove the reference to the file from the current LOAD= or RUN= line thus preventing the program from being called at boot time. The reference will be saved in the WIN.INI file as a comment; the logfile will be updated with the details of this change.

This option is useful if you are not sure that the program is a Malware file. By preventing it being called at boot time you can see if any Malware behaviour continues after a reboot. However you should note that some Malware files continuously rewrite their references in the Win.Ini file. If a scan by Trojan Remover after the reboot shows that the program is once again referenced in an active LOAD= or RUN= line you can be fairly confident that it is a Malware file. Select the ‘Prevent this program file from running, and rename the program file’ option (explained below).

Should you determine that the program should be loaded as normal, you can edit Win.Ini and remove the semi-colon from the start of the LOAD= or RUN= line in which the program name appears.

Prevent this program from running by removing its reference

Selecting this option will remove the call to this program from the LOAD= or RUN= line. This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.

The logfile will be updated with details of this change.

Prevent this program from running, and rename the program file

You should use this option only if you are sure that the program is in fact Malware.

Selecting this option will remove the call to this program from the LOAD= or RUN= line. Next Trojan Remover will attempt to rename the file. If the file cannot be located a warning will be displayed.

Trojan Remover may not be able to rename the file immediately if the program is in memory. Most Malware files adopt this method to try to make their detection and removal more difficult. In this event, Trojan Remover will offer to reboot the system and then rename this file. If you do not accept this option and the program is a Malware file, it is highly likely that the program will immediately re-infect the system.

If the file is successfully renamed details will be written to the logfile.

If the file cannot be located, you will be presented with these options:

Leave this reference in place

Choosing this option will mean that Trojan Remover will take no action. The file will continue to be called at boot time.

Comment this reference out of the WIN.INI file

Selecting this option will remove the reference from the current LOAD= or RUN= line in the WIN.INI file. The reference will be written to a new line in the WIN.INI - this new line will start with a semi-colon to ensure that Windows takes no notice of it. The logfile will be updated with details of this change.

Should you wish to later restore this reference you can edit WIN.INI and remove the semi-colon from the beginning of the LOAD= or RUN= line containing the referenced file name.

Remove this reference from the WIN.INI file

Selecting this option will remove the call to this program from the LOAD= or RUN= line. This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.

The logfile will be updated with details of this change.

Should the Malware be known to make system modifications and you elect to take action on it, Trojan Remover will offer to reset any changes made by the Malware.

See also:

Alerts

System.Ini Alert Options

Registry Alert Options

Startup Group Alert Options


Registry Alert Options

Trojan Remover examines all major keys in the Windows Registry that can be used to call a program or file at boot time. If it finds a program being called that it does not recognise it pops up an Alert box. The options available to you will depend on whether Trojan Remover can locate the referenced file. Select the required option by clicking on the appropriate radio button and then clicking on [image]:

If the file exists, Trojan Remover will scan it to see if it contains Malware. If the file is suspect a warning will be displayed. Clicking on the [image] button will open the Malware Reference Database and provide details on the Malware, if they are available.

If the file can be located you will be presented with the following options:

Continue to allow this program to load as normal

Selecting this option will make no changes - the program will continue to load at boot time (so long as it exists).

Prevent this program from running by removing its reference

Selecting this option will remove the call to this program from the Windows Registry. The logfile will be updated with details of this change.

This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.

Prevent this program from running, and rename the program file

You should use this option only if you are sure that the program is in fact a Malware file.

Selecting this option will remove the call to this program from the Windows Registry. Next Trojan Remover will attempt to rename the file. If the file cannot be located a warning will be displayed.

Trojan Remover may not be able to rename the file immediately if the program is in memory. Most Malware files adopt this method to try to make their detection and removal more difficult. In this event, Trojan Remover will offer to reboot the system and then rename this file. If you do not accept this option and the program is a Malware file, it is highly likely that the program will immediately re-infect the system.

If the file is successfully renamed details will be written to the logfile.

If the file cannot be located you will be presented with the following options:

Leave this reference in place

Choosing this option will mean that Trojan Remover will take no action. The file will continue to be called at boot time.

Remove this reference from the Windows Registry

Selecting this option will remove the call to this program from the Windows Registry. This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you may be getting each time you start Windows, stating that a file required by Windows is missing.

The logfile will be updated with details of this change.

Should the Malware be known to make system modifications and you elect to take action on it, Trojan Remover will offer to reset any changes made by the Malware.

See also:

Alerts

System.Ini Alert Options

Win.Ini Alert Options

Startup Group Alert Options


Startup Group Alert Options

Trojan Remover examines all files and programs called at boot time from any Startup Group, including User Startup Groups. If it finds a file or program that it does not recognise it pops up an Alert box. If the file is called via a Windows Shortcut, the options available to you depend on whether Trojan Remover can locate the referenced file:

If the file exists, Trojan Remover will scan it to see if it contains Malware. If the file is suspect a warning will be displayed. Clicking on the [image] button will open the Malware Reference Database and provide details on the Malware, if they are available.

Continue to allow this Shortcut to load as normal

Selecting this option will make no changes - the Shortcut will continue to load the file it references at boot time (so long as it exists).

Remove this Shortcut from the Start Group

Selecting this option will remove the Shortcut from the Startup Group from which it is loaded, thus preventing a call to the file it references. The logfile will be updated with details of this change.

This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the Shortcut will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.

This is also a good option to choose if you are uncertain that the called file is Malware. If you later determine that the file is not a Malware file you can re-instate the Shortcut.

If the file can be located you will be presented with this additional option:

Remove this Shortcut and rename the called file

You should use this option only if you are sure that the program is in fact Malware.

Selecting this option will remove the Shortcut from the Startup Group from which it is called. Next Trojan Remover will attempt to rename the file referenced by the Shortcut. If the file cannot be located a warning will be displayed. If the file is called from more than one Startup Group, then Trojan Remover may already have renamed the referenced file.

Trojan Remover may not be able to rename the file immediately if the program is in memory. Most Malware files adopt this method to try to make their detection and removal more difficult. In this event, Trojan Remover will offer to reboot the system and then rename this file. If you do not accept this option and the program is a Malware file, it is highly likely that the program will immediately re-infect the system.

If the file is successfully renamed details will be written to the logfile.

If the file is actually located in the Startup Group folder you will be presented with the following options:

Continue to allow this file to load as normal

Selecting this option will make no changes - the file will continue to be loaded at boot time (so long as it exists).

Prevent this file from loading by moving it

This is a good option to choose if you are not sure whether the file is Malware.

Selecting this option will move the file out of the Start Group in which it is located to the C:\Windows\System directory. As the file is called from the Startup Group it is quite possible that it is still in memory thus preventing its move. In this event Trojan Remover will offer to reboot the system and then move the file. If you do not accept this offer and the file is Malware it will simply continue to infect your system. If the file is successfully moved details will be written to the logfile.

If you later determine that the file is not Malware you can manually move it back to the Startup Group directory from which it was originally removed.

You can select the required option by selecting the appropriate radio button and then clicking on [image].

Should the Malware be known to make system modifications and you elect to take action on it, Trojan Remover will offer to reset any changes made by the Malware.

See also:

Alerts

System.Ini Alert Options

Win.Ini Alert Options

Registry Alert Options


System.Ini Alert Options

When Trojan Remover finds a program being loaded at boot time from the System.Ini file that it does not recognise it pops up an Alert box. The options available to you will depend on whether Trojan Remover can locate the referenced file. Select the required option by clicking on the appropriate radio button and then clicking on [image]:

If the file exists, Trojan Remover will scan it to see if it contains Malware. If the file is suspect a warning will be displayed. Clicking on the [image] button will open the Malware Reference Database and provide details on the Malware, if they are available.

If the file can be located you will be presented with the following options:

Continue to allow this program to load as normal

Selecting this option will make no changes - the program will continue to load at boot time (so long as it exists).

Prevent this program from running by commenting it out

Selecting this option will remove the reference to the file from the SYSTEM.INI file thus preventing the program from being called at boot time. The reference will be saved in the SYSTEM.INI file as a comment. Details of this change will be written to the logfile.

This option is useful if you are not sure that the program is Malware. By preventing it being called at boot time you can see if any Malware behaviour continues after a reboot. However you should note that some Malware files continuously rewrite their references in the SYSTEM.INI file. If a scan by Trojan Remover after the reboot shows that the program is once again referenced in the SYSTEM.INI file you can be fairly confident that it is Malware. Select the ‘Prevent this program file from running, and rename the program file’ option (explained below).

Should you determine that the program should be loaded as normal, you can edit SYSTEM.INI and remove the semi-colon from the start of the SHELL= or SCRNSAVE.EXE= line in which the program name appears.

Prevent this program from running by removing its reference

Selecting this option will remove the call to this program from SYSTEM.INI. Details of this change will be written to the logfile.

This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.

Prevent this program from running, and rename the program file

You should use this option only if you are sure that the program is in fact Malware.

Selecting this option will remove the call to this program from the SYSTEM.INI file. Next Trojan Remover will attempt to rename the file. If the file cannot be located a warning will be displayed.

Trojan Remover may not be able to rename the file immediately as the program is in memory. Most Malware files adopt this method to try to make their detection and removal more difficult. In this event, Trojan Remover will offer to reboot the system and then rename this file. If you do not accept this option and the program is Malware, it is highly likely that the program will immediately re-infect the system.

If the file is successfully renamed details will be written to the logfile.

If the file cannot be located you will be presented with the following options:

Leave this reference in place

Choosing this option will mean that Trojan Remover will take no action. The file will continue to be called at boot time.

Comment this reference out of the SYSTEM.INI file

Selecting this option will remove the reference from the current SYSTEM.INI file. The reference will be written to a new line in the SYSTEM.INI - this new line will start with a semi-colon to ensure that Windows takes no notice of it. The logfile will be updated with details of this change.

Should you wish to later restore this reference you can edit SYSTEM.INI and remove the semi-colon from the beginning of the line containing the referenced file name.

Remove this reference from the SYSTEM.INI file

Selecting this option will remove the call to this program from the SYSTEM.INI file. This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.

The logfile will be updated with details of this change.

Should the Malware be known to make system modifications and you elect to take action on it, Trojan Remover will offer to reset any changes made by the Malware.

See also:

Alerts

Win.Ini Alert Options

Registry Alert Options

Startup Group Alert Options


PIF Alert Options

Program Information Files (PIFs) are special files used by Windows to access MS-DOS applications. When Trojan Remover encounters a PIF it analyses the file to determine the nature and location of the target application. If the application can be found it is scanned for Malware.

The options available when a PIF Alert is displayed depend on where the PIF is loaded from and whether or not the target application could be located. The options are similar to those for other types of alert, but also allow for the renaming of the target application if it exists.


Autoexec.bat Alert Options

When Trojan Remover finds a suspect command line in the AUTOEXEC.BAT file an Alert screen will be shown. Suspect lines are defined as follows:

•	Any line beginning with DEL

•	Any line containing the word DELETE

•	Any line containing the word FORMAT

•	Any line containing the word DELTREE

The Alert will show the actual suspect line being examined.

You will be presented with the following options:

Leave this line in place

Choosing this option will mean that Trojan Remover will take no action. The line will remain active in the Autoexec.bat file.

Prevent this line from being executed by commenting it out

Trojan Remover will place a REM comment at the start of the suspect line, thus preventing it from being executed. This is the safest option to choose because if it is later determined that the line was required then it can be re-instated simply by removing the REM comment.

Prevent this line from executing by removing it

Trojan Remover will delete the line from the Autoexec.bat.

Should Trojan Remover make any modifications to the Autoexec.bat file it will save the original file as AUTOEXEC.TR. This file can then be used for recovery purposes if required.


Archive File Alert Options

If the option to Scan inside Archive files is selected, when scanning files from Windows Explorer, if Trojan Remover encounters an Archive File (i.e. a compressed file containing other files, e.g. a Zipfile) it will decompress the Archive and examine the files it contains individually.

NB: if the Archive file is password-protected it will not be scanned.

If one or more of the files contains Malware, an Alert Screen is displayed. This screen itemises the files contained within the Archive which appear to contain Malware and gives the Malware name. You are then presented with the following options:

Leave this file in place

Selecting this option will close the file-scan screen. No action will be taken on the file.

Delete this file (use with caution)

You should only select this option if you are absolutely positive that the file being scanned contains Malware. A copy will NOT be sent to the recycle bin. Once you answer YES to the confirmation message the file will be deleted. A record of this file deletion will be written to the Trojan Remover logfile. THIS ACTION IS IRREVERSIBLE.

Select the required option and click on the [image] button.

Trojan Remover can currently handle the following Archive filetypes:

.ARC, .ARJ, .BH, .LHA, .LZH, .RAR, .TAR, .UUE, .ZIP.

NOTE: when Trojan Remover scans archive files, it creates (and later deletes) temporary directories off the Windows Temporary Files (normally C:\Windows\Temp\) directory. Whilst scanning you may notice these temporary directories being created and deleted. This is normal and is no cause for concern.


SFX Archive File Alert Options

If the option to Scan inside Archive files is selected, when scanning files from Windows Explorer, if Trojan Remover encounters an SFX Archive File (a self-extracting archive file) it will decompress the file and examine the files it contains individually.

NB: if the Archive file is password-protected it will not be scanned.

If one or more of the files contains Malware, an Alert Screen is displayed. This screen itemises the files contained within the Archive which appear to contain Malware and gives the Malware name. You are then presented with the following options:

Leave this file in place

Selecting this option will close the file-scan screen. No action will be taken on the file.

Disable this file by renaming it

The file will be renamed so that it cannot be executed. If a file is suspicious, this is the best option to choose. You can then send a copy of the file to an anti-virus or trojan-scanner company (like Simply Super Software) for further analysis. A record of this rename operation will be written to the Trojan Remover logfile.

Delete this file (use with caution)

You should only select this option if you are absolutely positive that the file being scanned contains Malware. A copy will NOT be sent to the recycle bin. Once you answer YES to the confirmation message the file will be deleted. A record of this file deletion will be written to the Trojan Remover logfile. THIS ACTION IS IRREVERSIBLE.

Select the required option and click on the [image] button.

NOTE: when Trojan Remover scans archive files, it creates (and later deletes) temporary directories off the Windows Temporary Files (normally C:\Windows\Temp\) directory. Whilst scanning you may notice these temporary directories being created and deleted. This is normal and is no cause for concern.


Simply Super Software

There are a number of ways to contact Simply Super Software.

Email: support@simplysup.com

Trojan Remover website: http://www.simplysup.com/tremover/

Address:	PO Box 2849

Nuneaton

Warwickshire

United Kingdom

CV10 7YX


Malware Reference Database

You can access this database from the opening Trojan Remover screen by selecting ‘Help | Malware Reference’ from the main menu, or clicking on the [image] button. The database is searchable by Malware name and by the Port Number particular Remote Access Trojans use.

When searching, the program will find all Malware in the database that matches the given information. You can scroll through the entries using the [image] and [image] buttons. Individual Malware information can be printed by using the [image] button.


Registering Trojan Remover

Simply click on the Register Online Now! link on the opening Trojan Remover expiry warning screen. Alternatively, if the program has not yet expired, you can select Register | Register Trojan Remover... from the main menu.

Make sure that you are online - the link will launch your default web browser. You will be taken to a secure online server, where you can register Trojan Remover using your credit card.

Should you prefer not to provide your credit card details online, the site offers a way for you to enter your personal details, and then transmit your credit card information via phone or fax.

If you do not wish to pay by credit card the site shows how you can pay by check.

When ordering via phone, fax or mail, you will need to supply the following information:

•	The Product ID for Trojan Remover - this is 57822.

•	An email address so that the registration code can be sent to you quickly.

Contacting the Registration Company

Phone Ordering

•	Phone Ordering is a two-stage process. In order to minimise the possibility of errors you are first asked to input your personal information (Name, Address - but *NOT* payment information) at the secure registration website above - click on the “Phone” link. Once you have done this you will be taken to a page to print out which includes details of your order and the telephone number (toll-free in the US) to ring. You then call this number and provide your payment information (usually your credit card details).

Fax Ordering

•	US Toll-free Fax Order Number: 1-800-886-6030

•	International Fax Order Number: +1-208-279-3837 (UK Customers can fax to 0870 1322485)

Mail Ordering

RegSoft.com Inc.

9625 West 76th Street, Suite 150

Eden Prairie

MN 55344

Attention: Registrations

UK Customers Only

If you are based in the UK and wish to order by mail, you can send payment direct to:

Simply Super Software

PO Box 2849

Nuneaton

Warwickshire CV10 7YX

The cost is £20.00 Sterling. Please make all cheques payable to: NIGEL THOMAS.

When your registration has been authorised you will receive an email containing your Username and Licence Key. You will need to enter this information into the program in order to remove the expiry limitations. To do this, start Trojan Remover. When the expiry-warning screen appears click on the Enter Licence Key button. Enter your Username and Licence Key in the spaces indicated and click on the OK button. You should see a message stating that the registration has been successfully completed.


Boot-time
Boot-time Malware Scanning

Trojan Remover can be configured to scan for Malware every time you start the computer. This option is enabled by default. When enabled Trojan Remover scans all the system files, including the Registry, each time Windows is started. If a suspected Malware file is located an alert screen pops up advising you to run the main Trojan Remover program in order to disable the Malware.

Boot-time scanning can be enabled and disabled from the main Trojan Remover menu by selecting the appropriate option from the ‘Options’ menu, or clicking on the [image] and [image] buttons.


Trojan Scanner - WIN.INI Alert

Trojan Scanner is the component of Trojan Remover which runs each time you start your computer. It carries out the same scanning functions as are carried out when you run a Scan from within Trojan Remover itself.

When a suspicious file is found being loaded via a call in the WIN.INI file an alert screen is displayed. This screen shows the name of the file being loaded, whether it is being called by a run= or a load= line, and the line number in the win.ini file in which the call was found.

Once the scan is complete you should start Trojan Remover to remove this Malware.

Clicking on the [image] button will continue the scan.


Trojan Scanner - SYSTEM.INI Alert

Trojan Scanner is the component of Trojan Remover which runs each time you start your computer. It carries out the same scanning functions as are carried out when you run a Scan from within Trojan Remover itself.

When a suspicious file is found being loaded via a call in the SYSTEM.INI file an alert screen is displayed. This screen shows the name of the file being loaded, whether it is being called by a shell= or a scrnsave.exe= line, and the line number in the system.ini file in which the call was found.

Once the scan is complete you should start Trojan Remover to remove this Malware.

Clicking on the [image] button will continue the scan.


Trojan Scanner - Registry Alert

Trojan Scanner is the component of Trojan Remover which runs each time you start your computer. It carries out the same scanning functions as are carried out when you run a Scan from within Trojan Remover itself.

When a suspicious file is found being loaded via a call in the Windows Registry an alert screen is displayed. This screen shows the name of the file being loaded, and the Registry key in which the call was found.

Once the scan is complete you should start Trojan Remover to remove this Malware.

Clicking on the [image] button will continue the scan.


Trojan Scanner - Start Group Alert

Trojan Scanner is the component of Trojan Remover which runs each time you start your computer. It carries out the same scanning functions as are carried out when you run a Scan from within Trojan Remover itself.

When a suspicious file is found being loaded from any Startup Group (including individual User Startup Groups), either via a Shortcut Link or directly, an alert screen is displayed. This screen shows the name of the file being loaded, and if it is a Shortcut the actual file referenced by the Shortcut.

Once the scan is complete you should start Trojan Remover to remove this Malware.

Clicking on the [image] button will continue the scan.


Trojan Scanner - PIF Alert

Trojan Scanner is the component of Trojan Remover which runs each time you start your computer. It carries out the same scanning functions as are carried out when you run a Scan from within Trojan Remover itself.

When a suspicious Program Information File is found being loaded from any system file, Trojan Remover analyses the PIF to determine the target MS-DOS application. It then scans this application. If anything suspicious is found an alert is displayed showing the PIF name and where it is loaded from, and information on the target MS-DOS application referenced by the PIF.

Once the scan is complete you should start Trojan Remover to remove this Malware.

Clicking on the [image] button will continue the scan.


Trojan Scanner - Autoexec.bat Alert

When Trojan Remover finds a suspect command line in the AUTOEXEC.BAT file an Alert screen will be shown. Suspect lines are defined as follows:

•	Any line beginning with DEL

•	Any line containing the word DELETE

•	Any line containing the word FORMAT

•	Any line containing the word DELTREE

The Alert will show the actual suspect line being examined.

You will be presented with the following options:

Leave this line in place, and suppress future alerts on it

Choosing this option will mean that Trojan Remover will allow the line to remain active in the Autoexec.bat file. Further, Trojan Remover will record the line - for all subsequent scans, Trojan Remover will *not* raise an alert for this line. This is useful for users who use DELETE commands in the Autoexec.bat to remove temporary files on a regular basis.

If you wish to re-enable alerts on this line, select ‘Options > Reset Suppressed Autoexec.bat Alerts’ from Trojan Remover’s main menubar (this option will be greyed out if Trojan Remover is not currently suppressing any alerts).

Leave this line in place

Choosing this option will mean that Trojan Remover will take no action. The line will remain active in the Autoexec.bat file.

Prevent this line from being executed by commenting it out

Trojan Remover will place a REM comment at the start of the suspect line, thus preventing it from being executed. This is the safest option to choose because if it is later determined that the line was required then it can be re-instated simply by removing the REM comment.

Prevent this line from executing by removing it

Trojan Remover will delete the line from the Autoexec.bat.

Should Trojan Remover make any modifications to the Autoexec.bat file it will save the original file as AUTOEXEC.TR. This file can then be used for recovery purposes if required.


Alert Viewing Options

You can choose from three different levels of Alert Viewing. Trojan Remover can be set to only pop up an Alert screen when a confirmed Malware file is detected (the default), to pop up an alert on confirmed malware and files not located, or it can be set to show an Alert screen on all unknown files called at boot-time.

To set the Alert level select the required choice from the ‘Options’ menu; you can also click on the [image] or [image] button to choose between the first and third options.


Scanning A File From Windows Explorer

Right-click your mouse on the file you wish to scan. You should see the option ‘Scan with Trojan Remover’. Clicking on this option will start Trojan Remover and carry out an immediate scan on the highlighted file.

Should the file scanned appear to be a malware file, you will be presented with three different options:

Leave this file in place

Selecting this option will close the file-scan screen, and return you to the main Trojan Remover program. No action will be taken on the file.

Disable this file by renaming it

The file will be renamed so that it cannot be executed. If a file is suspicious, this is the best option to choose. You can then send a copy of the file to an anti-virus or trojan-scanner company (like Simply Super Software) for further analysis. A record of this rename operation will be written to the Trojan Remover logfile.

Delete this file (use with caution)

You should only select this option if you are absolutely positive that the file being scanned is Malware. A copy will NOT be sent to the recycle bin. Once you answer YES to the confirmation message the file will be deleted. A record of this file deletion will be written to the Trojan Remover logfile. THIS ACTION IS IRREVERSIBLE.

Once you have selected the desired option clicking on the OK button carries that operation out and returns you to the main Trojan Remover program.


Scanning A Directory From Windows Explorer

Right-click your mouse on the drive or directory you wish to scan and select the option ‘Scan with Trojan Remover’ (note: if you select a drive which is not accessible, for example it has no disk or CD in it, you will receive an error message).

The Trojan Remover program will be started and the Drive/Directory Scan screen displayed. The first time you run a Drive or Directory Scan you will be prompted to select the filetypes you wish to scan for. Your selection is saved and used in the future.

The screen will show which directory is to be scanned. If you do not wish to scan sub-directories of this directory, uncheck the box marked ‘Check sub-directories’. Pressing the ‘Start Scan’ button will start the scan. Details of the progress of the scan will be displayed. The scan can be stopped at any time by pressing the ‘Stop’ button. You can also pause the scan at any time by pressing the ‘Pause’ button. The scan will be paused until you either press the ‘Resume’ button to restart it, or press the ‘Stop’ button to cancel it.

You can decide which filetypes and which Archive filetypes are scanned by clicking on ‘Options’ in the menubar. Here you can also change the default Action to be taken.

Should a file be located which appears to be malicious, details are shown. If the default Action is to Prompt the User, a new screen will appear showing you details of the alert, allowing you to choose one of the following options:

Leave this file in place

Selecting this option will close the alert screen, and return you to the Drive/Directory scan. No action will be taken on the file.

Disable this file by renaming it

The file will be renamed so that it cannot be executed. If a file is suspicious, this is the best option to choose. You can then send a copy of the file to an anti-virus or trojan-scanner company (like Simply Super Software) for further analysis. A record of this rename operation will be written to the Trojan Remover logfile.

Note: if the file has already been renamed by Trojan Remover, or it is an Archive (i.e. Zip) file, then this option is not given.

Delete this file (use with caution)

You should only select this option if you are absolutely positive that the file being scanned is Malware. A copy will NOT be sent to the recycle bin. Once you answer YES to the confirmation message the file will be deleted. A record of this file deletion will be written to the Trojan Remover logfile. THIS ACTION IS IRREVERSIBLE.

Once you have selected the desired option clicking on the OK button carries that operation out; the scan then proceeds (unless you choose to stop it).

NOTE: when Trojan Remover scans archive files, it creates (and later deletes) temporary directories off the Windows Temporary Files (normally C:\Windows\Temp\) directory. Whilst scanning you may notice these temporary directories being created and deleted. This is normal and is no cause for concern.


Scanning A Drive or Directory

You can scan a selected Drive or individual Directory by clicking on the [image] from the main Trojan Remover menubar. If you have not already done so, you will be prompted to first run a Scan for active Malware.

The Scan a Drive/Directory screen shows drive and directory selection boxes. Highlight the directory you wish to scan and click on the ‘Start Scan’ button to carry out the scan. If you select a drive that is not accessible (e.g. a CDROM drive with no disk in it) then an error message will be displayed.

You can select the default Action to be carried out if a Malware file is detected using the Action selection box (or by selecting ‘Options | Action To Take…’ from the menubar). The Actions available are:

Prompt User For Action

With this selection chosen, if a Malware file is detected an alert screen will be displayed and the Scan paused until you have determined what action you wish to carry out.

Automatically Rename Malware Files

If a Malware file is detected, the file will automatically be renamed and the Scan will continue. Note: if the Malware is located in an archive file, then the file will not be automatically renamed.

Report Only

No action will be taken on any Malware detected. Details will be reported, and recorded in the logfile.

If you wish to change the filetypes that are scanned for, select ‘Options | Files To Scan’ from the main menubar.


Directory Scanning Preferences

All filetypes that Trojan Remover is designed to scan are included by default.

To change which filetypes are included when you scan a drive or directory click on the ‘Options’ button on the Drive/Directory Scan screen. This brings up the Scan Preferences  screen to allow you to check/uncheck the available filetypes, including Archive filetypes. If a particular filetype is checked then it will be included in the scan. If it is not then any files with that file extension will be ignored.

.COM, .DLL and .EXE files will always be scanned - these filetypes cannot be excluded.

If you also wish to scan inside Archive files, place a checkmark next to ‘Scan inside Archive Files’. Archive file scanning is not enabled by default as it can substantially decrease the scan-speed. Also, if a malicious file is located inside an Archive file, it cannot be activated unless it is first extracted from the Archive file.


Sending A File For Analysis

If you are unsure that a file detected by Trojan Remover is actually Malware you may wish to send a copy to Simply Super Software for further analysis. The file should be placed in a zip file password-protected with the password infected. Details of how to do this are below.

Then send the file as an email attachment to support@simplysup.com with the subject ‘File For Analysis’.

When sending the email, please be sure to include:

1) 	an email address where you can be contacted

2) 	details of why you believe the file to be infected

Creating a password-protected zip file

If you have Windows XP:

1.	Using Windows Explorer, locate the file you want to zip.

2.	Right-click on the file and select “Send To” and “Compressed (zipped) folder”.

3.	Right-click any other files you want to add and select “Copy”.

4.	Right-click on the compressed folder and select “Paste”. The copied files will be compressed and pasted in.

5.	Right-click on the compressed file and select “Explore”.

6.	Click on “File” in the Windows Explorer top menubar and select “Add a Password”. Enter the password infected and confirm the password. The file is now ready to be sent.

If you have an earlier version of Windows:

1.	Download a zip utility. An evaluation version of WinZip is available free from www.winzip.com. Other utilities are available from: http://www.freedownloadscenter.com/utilities/Compression_and_Zip_File_Utilities - the instructions below are for WinZip.

2.	Using Windows Explorer, locate the first file you want to zip.

3.	Right-click on the file and select “WinZip” and “Add to Zip File”.

4.	In “Add to Archive” enter the path and name you want your zip file to have.

5.	Click “Password” and enter the password infected

6.	Click “Add”.

7.	If you wish to add other files, on the WinZip window that appears, click “Add” and select any other files you want to add to the zip file.

8.	When you have finished adding files, select “File” and “Close Archive”. The zip file is now ready for sending.


Trojan Alert - File Scan

A file scanned by Trojan Remover may contain Malware. The alert screen shows the file name and location, and which Malware (if identified). You have three options:

Leave this file in place

Selecting this option will close the file-scan screen, and return you to the main Trojan Remover program. No action will be taken on the file.

Disable this file by renaming it

The file will be renamed so that it cannot be executed. If a file is suspicious, this is the best option to choose. You can then send a copy of the file to an anti-virus or trojan-scanner company (like Simply Super Software) for further analysis. A record of this rename operation will be written to the Trojan Remover logfile.

Delete this file (use with caution)

You should only select this option if you are absolutely positive that the file being scanned is Malware. A copy will NOT be sent to the recycle bin. Once you answer YES to the confirmation message the file will be deleted. A record of this file deletion will be written to the Trojan Remover logfile. THIS ACTION IS IRREVERSIBLE.

Once you have selected the desired option clicking on the OK button carries that operation out; if there are further files to be scanned the scan will continue.

If the file being scanned has already been renamed by a previous Trojan Remover operation the Alert Screen will state this. You will not have the option to Rename this file, as it has already been renamed. When you are certain that the file is actually a malicious file, and not a valid system file which has been wrongly renamed, you should select the Delete option.


Scheduling Unattended Scans

It is possible to use the Windows Task Scheduler to carry out automatic scans with Trojan Remover. You can elect to schedule the on-boot scanner to activate at regular intervals (useful if you do not shut down your PC daily) - this will carry out a quick scan for active Malware, and alert you if it detects anything. Alternatively, you can schedule a scan for a particular drive or directory. When activated, Trojan Remover will scan the drive/directory chosen.

Scheduling a scan for active Malware (the on-boot scanner)

Open the Windows Task Scheduler, and double-click on ‘Add Scheduled Task’. This will start the Scheduled Task Wizard. Click on the ‘Next’ button. In the screen that appears, click on the ‘Browse’ button. Browse to the directory where you installed Trojan Remover (C:\Program Files\Trojan Remover by default) and double-click on the Trjscan.exe program. In the next two screens select the times you want the scanner to run. Clicking on the ‘Finish’ button on the last page closes the Wizard and your scheduled task is set up.

Scheduling a drive/directory scan

This requires slightly more work than the above task, as you need to specify to Trojan Remover what drive or directory it has to scan when activated.

Open the Windows Task Scheduler, and double-click on ‘Add Scheduled Task’. This will start the Scheduled Task Wizard. Click on the ‘Next’ button. In the screen that appears, click on the ‘Browse’ button. Browse to the directory where you installed Trojan Remover (C:\Program Files\Trojan Remover by default) and double-click on the Rmvtrjan.exe program. In the next two screens select the times you want the scanner to run. In the final screen, place a checkmark in the box labeled ‘open advanced properties for this task when I click Finish’. Click on the ‘Finish’ button - in the screen that comes up, look at the box labeled ‘Run:’. In here you will find the command that the Scheduler will actually run - it will look something like this:

C:\PROGRA~1\TROJAN~1\RMVTRJAN.EXE

This line will differ depending on where your copy of Trojan Remover is actually installed.

This is where we will tell Trojan Remover what drive or directory to scan. Click your mouse inside this box so that you can edit what is there. Move to the end of the line, and add the following parameters (preceded by a space):

/d [drive or directory name]

where [drive or directory name] is the actual drive or directory you wish to scan. Here are some examples:

C:\PROGRA~1\TROJAN~1\RMVTRJAN.EXE /d C:\ - this will scan the whole C: drive

C:\PROGRA~1\TROJAN~1\RMVTRJAN.EXE /d C:\Windows\ - scans the Windows directory

Once you have edited the line correctly, click on the ‘OK’ button - your task is now scheduled.

Should you decide to schedule a task like this, it is recommended that you change the Action: in the Drive/Directory screen to ‘Report Only’ from the default ‘Prompt User for Action’. In this way if a Malware file is discovered, the scan will continue. You can then manually run a new scan to actually remove the Malware found.


Scheduling Automatic Update Checks

It is possible to use the Windows Task Scheduler to schedule automatic update checks.

Open the Windows Task Scheduler - START > Programs > Accessories > System Tools > Scheduled Tasks. This will start the Scheduled Task Wizard. Click on the ‘Next’ button. In the screen that appears, click on the ‘Browse’ button. Browse to the directory where you installed Trojan Remover (C:\Program Files\Trojan Remover by default) and double-click on the trupd.exe program. In the next two screens select the days/times you want the automatic update check to be carried out. It is important to select a time when you are fairly confident that the PC will be connected to the Net. The Updater cannot start its own Internet connection so the PC must already be connected.

If you are on XP, you may be asked to also input your User Account password.

In the final screen, place a checkmark in the box labeled ‘Open advanced properties for this task when I click Finish’. Click on the ‘Finish’ button. In the screen that comes up, look at the box labeled ‘Run:’. In here you will see the command that has been set up to run the Updater.

Click your mouse inside this box so that you can edit what is there. Move to the end of the line and add the following parameter, preceded by a space:

/silent

The line should then be similar to:

C:\Program Files\Trojan Remover\trupd.exe /silent

Of course it may differ on your PC if you have installed Trojan Remover to a different directory.

Once you have edited the line correctly click on the ‘OK’ button - the task is now scheduled.

When the scheduled automatic update is started, it will silently attempt to contact the update website. If a Program or Database update is found, the normal Updater screen will be displayed allowing you to manually proceed with the update, or cancel it. If no update is found, or a connection could not be made, a note will be added to the Update logfile. This logfile can be viewed in Trojan Remover by selecting ‘Utilities > View Update Log’.

** IMPORTANT**

For the Updater to be able to connect to the update website, the PC must be connected to the Internet when the Updater runs. Also, you must ensure that any firewall you have installed is configured to allow the Updater program trupd.exe to connect to the Net.