When Trojan Remover finds a file being loaded from a LOAD= or a RUN= line in the Win.Ini that it does not recognise it pops up an Alert screen. The options available to you will depend on whether Trojan Remover is able to locate the referenced file. Select the required option by clicking on the appropriate radio button and then clicking on the OK button:
If the file exists, Trojan Remover will scan it to see if it contains Malware. If the file is suspect a warning will be displayed. Clicking on the Details button will open the Malware Reference Database and provide details on the Malware, if they are available.
If the file can be located, you will be presented with these options:
Continue to allow this program to load as normal
Selecting this option will make no changes - the program will continue to load at boot time (so long as it exists).
Prevent this program from running by commenting it out
Selecting this option will remove the reference to the file from the current LOAD= or RUN= line thus preventing the program from being called at boot time. The reference will be saved in the WIN.INI file as a comment; the logfile will be updated with the details of this change.
This option is useful if you are not sure that the program is a Malware file. By preventing it being called at boot time you can see if any Malware behaviour continues after a reboot. However you should note that some Malware files continuously rewrite their references in the Win.Ini file. If a scan by Trojan Remover after the reboot shows that the program is once again referenced in an active LOAD= or RUN= line you can be fairly confident that it is a Malware file. Select the 'Prevent this program file from running, and rename the program file' option (explained below).
Should you determine that the program should be loaded as normal, you can edit Win.Ini and remove the semi-colon from the start of the LOAD= or RUN= line in which the program name appears.
Prevent this program from running by removing its reference
Selecting this option will remove the call to this program from the LOAD= or RUN= line. This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.
The logfile will be updated with details of this change.
Prevent this program from running, and rename the program file
You should use this option only if you are sure that the program is in fact Malware.
Selecting this option will remove the call to this program from the LOAD= or RUN= line. Next Trojan Remover will attempt to rename the file. If the file cannot be located a warning will be displayed.
Trojan Remover may not be able to rename the file immediately if the program is in memory. Most Malware files adopt this method to try to make their detection and removal more difficult. In this event, Trojan Remover will offer to reboot the system and then rename this file. If you do not accept this option and the program is a Malware file, it is highly likely that the program will immediately re-infect the system.
If the file is successfully renamed details will be written to the logfile.
Exclude this file from future scans
Choose this option if you no longer wish Trojan Remover to show an alert screen when this file is scanned. No action will be taken on the file. You should note that if you select this option, the file will continue to be excluded from future scans, even if, when such a scan is carried out, the file is no longer in-use/locked. If you select this option to exclude the file from future scans, you can arrange for the file to be re-included in future scans by selecting File > Manage Excluded Files from the main menu.
If the file cannot be located, you will be presented with these options:
Leave this reference in place
Choosing this option will mean that Trojan Remover will take no action. The file will continue to be called at boot time.
Comment this reference out of the WIN.INI file
Selecting this option will remove the reference from the current LOAD= or RUN= line in the WIN.INI file. The reference will be written to a new line in the WIN.INI - this new line will start with a semi-colon to ensure that Windows takes no notice of it. The logfile will be updated with details of this change.
Should you wish to later restore this reference you can edit WIN.INI and remove the semi-colon from the beginning of the LOAD= or RUN= line containing the referenced file name.
Remove this reference from the WIN.INI file
Selecting this option will remove the call to this program from the LOAD= or RUN= line. This option is useful if you determine that a program or file being called does not actually exist on your system. Removing the reference will eliminate the error you get each time you start Windows, stating that a file required by Windows is missing.
The logfile will be updated with details of this change.
Should the Malware be known to make system modifications and you elect to take action on it, Trojan Remover will offer to reset any changes made by the Malware.
See also:
Alerts
System.Ini Alert Options
Registry Alert Options
Startup Group Alert Options
[Main] 