Frequently asked questions

When Trojan Remover launches, it creates a randomly named copy of the main executable file, then launches this copy. This is part of the Trojan Remover defences against malicious process killers. Some process monitors see this behaviour as suspicious.

You should instruct your process monitor to always allow this behaviour by Trojan Remover, or you will continue to get alerts each time the program is launched. However, if your process monitor acts simply on filenames, and does not check the executable properly (by MD5 signature, for example), then you may continue to see alerts, because the Trojan Remover main filename is different each time it is launched.

One way to stop these alerts is to start Trojan Remover, select Options, and turn off the option for random filename generation protection. You should then instruct your process monitor to always allow Trojan Remover to launch RMT.EXE.

Turning off random filename generation does make Trojan Remover more vulnerable to malicious process killers. However, your process monitor itself should prevent any such malicious activity, so there should be no increased risk.

Back to top

Yes, you should allow this action. TRDUMMYnn is part of the Trojan Remover routines to check for stealthed (rootkit) drivers. Trojan Remover writes a dummy service entry to the registry, just to confirm that it has write access. The entry is immediately deleted. You should instruct your firewall or process monitor to always allow this.

Back to top

Start Trojan Remover. When the hidden install alert appears, click on Add to Trusted Zone. In the screen that appears, click on the blue highlighted hidden install message next to Verdict mask. In the box that appears, remove the checkmark from the Advanced Settings box. Click on OK to close the box, then click on OK again to close the exclusion mask box. The hidden install alert should no longer appear when you start Trojan Remover.

Back to top

This means that during the scan, or during an earlier scan, you selected the option to disable one or more files from scanning when you were presented with an alert screen. You can review which files are currently excluded from scanning by selecting File, then Manage Excluded Files from the Trojan Remover main menu. Here you can add, remove or edit the entries.

Back to top

Some malware programs deliberately try to prevent the installation of antimalware programs. If, when trying to install Trojan Remover, you see the installation screen completely disappear while you are installing the program, this is probably being caused by the malware program shutting down our installer.

The workaround is to run a silent install. Make sure you have saved the setup file (trjsetup followed by the version number, or trj followed by the version number if you are running a program update) to a directory on your PC. Click Start, then Run. In the box that comes up, type in:

"<path to file>\trjsetup681.exe" /silent

and press the ENTER key. Replace the path text with the actual path to where you saved the downloaded setup file. Make sure the path and filename are surrounded by quotes, as shown above. For example, if you saved the setup file to C:\My Downloads, then the command would look like this:

"C:\My Downloads\trjsetup681.exe" /silent (there is a space before the silent switch).

This installs Trojan Remover to the default directory, C:\Program Files\Trojan Remover. You will see a progress window as the installation proceeds. You may need to try this a couple of times, because the installation is fast but it needs to be faster than the malware trying to stop it. You will know the install has succeeded when the Trojan Remover icon appears on the desktop.

If you still cannot install Trojan Remover using this method, try installing the program in Safe mode.

Back to top

The usual reason for errors when uninstalling Trojan Remover is that one or more components have been manually removed. The fix is to download and install a new full copy of the program. Once installed, go to Start, then All Programs, then Trojan Remover, then Uninstall Trojan Remover. In Windows Vista, go to Start, then Control Panel, then Programs, then Uninstall a Program, select Trojan Remover, then click the Uninstall button near the top of the window.

Back to top

Instructions on how to send files to Simply Super Software for analysis are on the contact us page. Samples should be placed inside a password protected archive before they are sent.

Back to top

This is a quarantine function. Trojan Remover renames malware files by adding an extension to the filename. This disables the file from being run. If the file were immediately and permanently deleted, and you then realised you wanted to keep it, either for analysis or because it was a rare false positive detection, it would be too late.

By renaming the file, you have the opportunity to restore it if you wish, simply by removing the added extension. When you have decided you do not want to keep the disabled file, you can simply delete it.

You can also run a directory scan with the option to scan files already renamed by Trojan Remover checked. When such a file is located, Trojan Remover offers to permanently delete it.

Back to top

Earlier versions of Trojan Remover required the Microsoft Windows file GDIPLUS.DLL. Later versions do not. Update your program to the latest version and this should resolve the issue. To update, download and manually install the latest program update from the updates page.

Back to top

The most likely cause is a known conflict with System Mechanic, from Iolo Systems. The support page has more detailed information on this problem and a workaround.

Back to top

This error message can be caused by a malware program attempting to prevent Trojan Remover from running. Try the following workaround to run a scan.

Locate the Trojan Remover program files directory, normally C:\Program Files\Trojan Remover. Make a copy of the file rmvtrjan.exe. Rename this copy to a different name, anything you choose, for example mynewprog.exe. Double click on this renamed file to start Trojan Remover. The program should now start, and you will be able to run a scan.

Back to top

When you start the PC and the FastScan screen appears, sometimes the screen appears to be blacked out, and the title bar says that the FastScan program is not responding. This happens when Vista is busy dealing with all the other program startup requirements. There is no need for you to do anything: the FastScan starts scanning correctly once it is allocated enough processor time.

Back to top

If you have User Account Control enabled, which is the default and which Microsoft recommend you leave enabled, each time you start Trojan Remover you will see a UAC elevation prompt. This is because Trojan Remover requires access to protected system areas and processes.

It is more sensible to ask for UAC elevation the one time, when the program starts, rather than ask each time a different protected area is accessed during the scan. A future version will design around this limitation and only request UAC elevation when action is required on a protected registry key or file.

Back to top