Have just found ' andt.sys ' on my PC. Is this a 'trojan', if so how do I get rid of it as it won't let me delete it. Any help would be appreciated. [/b]

If you still have the file on your PC please add it to a .zip file (right click on it -> send to -> compresses zip file) and upload it to this post as an attachment.

If you have Windows XP install Windows Defender from http://www.microsoft.com/athome/security/spyware/software/default.mspx

Then run Windows Update (Internet Explorer -> Tools -> Windows Update) and install all the patches.

Then open Windows Defender and do a "full scan".

Then have a look at http://wiki.castlecops.com/MRP

After you've followed the instructions, if you are still infected or worried that you may be please make a post in /f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html and someone will help you.

Thanks for your comments. I attach the offending file 'andt.sys'.

I have Windows Vista and have run a full scan with Windows Defender aswell as a full scan with Norton. Neither have picked up anything harmful. However the file is still on my system and browsing on the internet it does say the file is dangerous.

What should I do next. Thanks

Hi download and run the free version of the following Botkiller>>>
http://www.superantispyware.com/

It has this Trojan-Downloader in its target database(i have confirmed this by custom file scan )

VirusTotal have confirmed it as malware too.

/p1054713-MD5_f7f8d30c5c9b9f20e2835dc3b275510f_andt_sys.html#1054713

So i have escalated it onto Malware Listserve for distribution to the defenders.Thankyou for sharing this malware

Thanks for all your help. Have run SuperAntiSpyware and it has picked up the 'andt.sys' file and deleted it. However the file keeps re-appearing. Is there a way of getting rid of it once and for all or do I have to keep running SuperAntiSpyware everyday. Thanks

Have a look at http://wiki.castlecops.com/MRP

After you've followed the instructions, if you are still infected or worried that you may be please make a post in /f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html and someone will help you.