Forum Moderators: open
Cheers, Limbo.
Backdoor.NetTrojan can be configured in many different ways. If the Trojan is set to use its default settings, it does the following:Copies itself as %Windir%\Unwise.exe. It also deletes the files from that particular folder.
NOTE: %Windir% is a variable. The virus locates the Windows installation folder (by default, this is C:\Windows or C:\Winnt) and copies itself to that location. It deletes the files from this folder as well.
Looks like it was a false alarm. The file was one of a few unwise.exe files found within the programmes folder and within opera, lavasoft and macromedia applications. Used by these programs to uninstall files. The Trojan has the same file name but is not related and should be picked up by up-to-date AV protection. Checked my registry and 2 machines at work and found no instance of the trojan but did find identical unwise files in each of the applications mentioned.
Thanks for your help anyway, always better to be safe than sorry :)