How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.

A new variant of the Troj_Renos.ACO infection was discovered that installs a file called lphc3pgj0e3ct.exe into your C:WindowsSystem32folder. This infection is installed on your computer by one of the following three methods:

  • This Trojan may be downloaded from remote site(s) by other malware.
  • It may be dropped by other malware.
  • It may be downloaded unknowingly by a user when visiting malicious Web site(s).

When started, the infection will connect to a remote web site to download and run another file that is also detected as Troj_Renos.ACO.  It then copies itself to C:WindowsSystem32lphc3pgj0e3ct.exe and adds a entry into the Windows Registry to start the file everytime you boot your computer.

This infection will also change your Windows desktop wallpaper to look like:

Trojan Renos Wallpaper

Trojan Renos Wallpaper

Automatic Removal Method

If you are infected with this malware, then we suggest you use Trend Micro antivirus to remove this infection. It is know to be able to remove this malware and it is included in its current virus definitions.  A big thumbs up for Trend Micro for being able to remove this infection so quickly.

DownloadDownload Trend Micro Antivirus to scan your computer

Manual Removal Instructions for

End these processes:

Learn how to end processes

lphc3pgj0e3ct.exe


Delete these files:
Lean how to remove files

C:WindowsSystem32lphc3pgj0e3ct.exe
C:WindowsSystem32phc3pgj0e3ct.bmp
C:WindowsSystem32blphc3pgj0e3ct.scr

Remove these Registry keys:

Learn how to remove Windows Registry entries

Warning: Editing the Windows Registry incorrectly can cause problems with your computer that may cause it not to operate correctly.  Please edit the Registry only if you know what you are doing.  Otherwise, please use the automated removal method above.

HKEY_LOCAL_MACHINESOFTWAREMicrosoft
WindowsCurrentVersionRun
lphc3pgj0e3ct = “%System%lphc3pgj0e3ct.exe”

del.icio.us:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  digg:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  spurl:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  wists:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  simpy:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  newsvine:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  blinklist:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  furl:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  reddit:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  fark:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  blogmarks:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  Y!:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  smarking:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  magnolia:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  segnalo:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.  gifttagging:How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.

This entry was posted on Thursday, July 24th, 2008 at 3:44 pm and is filed under Malware Removal Guide, Trojan. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Leave a Reply