Troj/Dluca-C

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Mscnt = C:\<Windows system>\MSCNT.EXE /noconnect

and delete it if it exists.

Close the registry editor.

Troj/Dluca-C is a downloading Trojan which runs in the background and attempts to download files from the internet to the computer without the user's knowledge and then execute them.

The Trojan moves itself to the Windows system folder as MSCNT.EXE and adds the following entry to the registry to run itself on system restart:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Mscnt = C:\<Windows system>\MSCNT.EXE /noconnect

Trih/Dluca-C also creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mscnt\
DisplayName = Mscnt

HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mscnt\
UninstallString = C:\<Windows system>\MSCNT.EXE /uninstall

HKCU\Software\mscnt\Info = "Use Add/Remove Programs to Uninstall"

Executing MSCNT.EXE with the /uninstall option uninstalls Troj/Dluca-C but may
not remove all files and registry entries created by the application.