Vinzenz Feenstra’s WebLog

I have previous posted about the Windows threat ‘Trojan.downloader.uj’ and that I have build a removal help tool for it.

I think it would be best for all if I post here some removal steps for this special threat which is really tricky, since it is a trojan but uses userland rootkit techniques.

Here are the steps:

1. Download the file "rmdlagentuj.exe" from following location: http://fileserver.ewido.net/public.cgi?id=20845
2. Execute the file "rmdlagentuj.exe" if it was successful you will get a message dialog where you will be asked to reboot
3. Reboot your computer (Important!)
4. Execute a complete system scan with ewido anti-spyware 4.0 ( http://www.ewido.net )

Or you can try Grisoft AVG Anti-Rootkit Beta 1.0.0.13, but be careful it is a beta!
Thats’s all the threat should be removed now.

Aliases for this threat are:

I hope this is helpful.

Regards,

Vinzenz Feenstra

Tags: Removal, Steps, Security, Windows, Userland, Rootkit, Rootkits, Tutorial