Trojan Horse?

Question

i have formatted the c: drive, reinstalled the windows but the Trojan horse remains in c:\WINDOWS\MDM.EXE.
I have re-installed it from the Microsoft CD. After the fresh installation i installed Norton antivirus and had the latest virus updates. but when i click on my D: Drive to access some files the trojan again appears. and the norton real time protection gave me the MSG: "Virus Found: name: Trojan Horse: location/ file: C:\Windows\MDM.EXE"
now my question is, if virus is in the file which is located in D: Drive then why norton real time protection giving me the Wrong location, plus when i scan my computer with the norton antivirus it didn’t find any virus in D: Drive.

Answer 1

DANGER WILL ROBINSON!! DANGER DANGER!!

Answer 2

MDM.EXE is the Windows 'Machine Debug Manager'.

There are Trojans and Worms that use that .EXE also.

Here is the kicker, Norton will tell you that you have this Trojan. This was a trick to get users of older versions of Norton to upgrade to 2007.

So, what you need to do is run a very good Trojan detector and removal program. If this it doesn't find this Trojan then you know Norton is playing games with you. If it does find it, it will remove the Trojan. Do the scan in Safe Mode. Here is the program.

http://www.ewido.net/en/download/

SAFE MODE:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.

Answer 3

It may very well NOT be a virus, though. A debugger needs exclusive access to the system and the system's files.

Virus scanners search each file for "fingerprints" of known viruses. Given how a debugger works, Norton may just be seeing MDM.exe's activity as similar to a known virus, so it's alerting you.

That's a possibility. I came up with it because if you formatted the C: drive, meaning NOTHING is left, and re-installed Windows, there's no way it's a virus, as long as your Windows installation CD is a legal retail copy.

Answer 4

The answer is somewhere in what you think you did, but really did not do. It sounds to me like you did a " repair existing" rather than a clean install. You say you formatted. In order to erase all
existing data (including viruses) you have to RE-FORMAT! Norton is not giving you the wrong location. I don't think you have a Drive "D". It sounds like the Windows folder has been put into another folder named "Drive D". If everything else is working fine for you, I think you should just zap the Trojan with Norton and move on.

Answer 5

The Norton is givein you the right location as there may be more than one copy of the trohjan. Scan your system in the Safe mode. Also note down the location of the file and delete it manually .
ALso scan ur system for any malwares. Get he updated Ad-aware by lavasoft SE (and yes updated Norton 2005 SE if u wish to ) from here
www.i-search.co.in
Again scan it in the safe mode only and use dnt forget to disable system restore before scanning. This is must otherwise the trojan restores their previous status

Answer 6

You should go to this web site to have it check your mdm.exe...

http://www.liutilities.com/products/wintaskspro/processlibrary/mdm/

mdm.exe is used in windows for debugging.. or it CAN be a virus.. you need to find out which one you have...

I prefer ZoneAlarm Security Suite, costs about $50 or so (I forget now) and I have a link to it on my webpage:

http://www.tom-olsen.com/links.html

I also have some links to FREE graphics programs from Serif (you have to register them but even registration is FREE)

Answer 7

I have a similar problem too. My Norton anti-virus prompt me that there's Trojan horse in my com. When i scan it using other anti virus software (i tried 2 different), they couldn't find any.

Answer 8

Suggest you go into Safe Mode and run a full scan of every drive, then reboot. Icons may be messed up. Drag them back into place.