IRC backdoor trojan

Joneser · Oct 23, 2002, 08:37 PM

Does anyone know how to get rid of this trojan. It is attached to Windows/explorer.exe. I am running XP pro.

Any help would be greatly appreciated.

Joneser

UberLord · Oct 24, 2002, 02:05 AM

Run an upto date anti-virus tool. AVG make a free one.

Joneser · Oct 25, 2002, 12:29 AM

Quote:

Originally posted by UberLord
Run an upto date anti-virus tool. AVG make a free one.

I ran the program fromAVG w/ no luck. The program didn't even turn up the trojan. Is it possible this is a false hit by Norton?? I'm open to all options, formatting my hard drive just doesn't seem like very much fun

Any other ideas

Erroneus · Oct 25, 2002, 01:16 AM

go to http://securityresponse.symantec.com/ and find your virus, they properly have guide how to remove it..

UberLord · Oct 25, 2002, 01:34 AM

Quote:

Originally posted by Joneser
I ran the program fromAVG w/ no luck. The program didn't even turn up the trojan. Is it possible this is a false hit by Norton?? I'm open to all options, formatting my hard drive just doesn't seem like very much fun

Any other ideas

You mention Norton - I take it ur running Norton AntiVirus 2002 or later. So it detects the virus but cannot remove it?

Hmmm. Try disabling heurstic (spelling?) checking as this does pattern matching and can produce a few false positives. Saying that, I use Norton at home occasionally (normally I don't run anti-virus) and McAfee at work. Norton's yet to throw up a false positive at it's maximum settings, but McAfee throws up loads of false positives.

~~JAV~~ · Oct 25, 2002, 02:43 AM

Just a thought: Try deleting all your .~tmp (temporary) files & scrub your cookies (sounds funny, don't it) & cached files. Then reboot & run the AV again. You may then be able to remove it & it won't re-install.

You can also try 'System Mechanic' & run the registry scan & see if the Trojan is in there & remove it. Then reboot & run AV again.

Can't say for sure these *will* solve your problem, but it couldn't hurt anyway & is easier than reformatting. You'll have to sign in @ all your regular sites (DH) when you visit because your cookies will be gone & you won't be reconized.

HTH,

JAV
GBA!

Zardon · Oct 25, 2002, 08:54 PM

http://www.anti-trojan.net/en/home.aspx

Oct 23, 2002, 08:37 PM	#1
Joneser DriverHeaven Junior Member Join Date: Jul 2002 Location: Ohio Posts: 40 Rep Power: 0	IRC backdoor trojan Does anyone know how to get rid of this trojan. It is attached to Windows/explorer.exe. I am running XP pro. Any help would be greatly appreciated. Joneser __________________ [color=yellow]<<Athlon XP 1800>><<512 Infin. PC2100>><<ECS K7S5A>><<GXP120 80 Gig>><<Geforce 3 Ti500>><<Turtle Beach Santa Cruz>><<56x CD-Rom>><<40x12x48x Lite-On>><<400 Watt Mofo. PS.>><<WinXP Pro>>[/color]

Oct 24, 2002, 02:05 AM	#2
UberLord A Legend in Underwear Join Date: May 2002 Location: Unknown Posts: 5,255 Rep Power: 0	Run an upto date anti-virus tool. AVG make a free one. __________________ Gentoo Linux - Developer (baselayout) Read my blog "I contend that we are both atheists. I just believe in one fewer god than you do. When you understand why you dismiss all the other possible gods, you will understand why I dismiss yours." Stephen Roberts

Oct 25, 2002, 01:16 AM	#4
Erroneus Get off my lawn! Join Date: Aug 2002 Location: Denmark Posts: 13,417 Rep Power: 119 System Specs	Symantec go to http://securityresponse.symantec.com/ and find your virus, they properly have guide how to remove it.. __________________

Oct 25, 2002, 02:43 AM	#6
~~JAV~~ Banned Join Date: Jul 2002 Location: California, USA Posts: 283 Rep Power: 0	Just a thought: Try deleting all your .~tmp (temporary) files & scrub your cookies (sounds funny, don't it) & cached files. Then reboot & run the AV again. You may then be able to remove it & it won't re-install. You can also try 'System Mechanic' & run the registry scan & see if the Trojan is in there & remove it. Then reboot & run AV again. Can't say for sure these will solve your problem, but it couldn't hurt anyway & is easier than reformatting. You'll have to sign in @ all your regular sites (DH) when you visit because your cookies will be gone & you won't be reconized. HTH, JAV GBA!

Oct 25, 2002, 08:54 PM	#7
Zardon DriverHeaven Founder Join Date: May 2002 Posts: 32,480 Rep Power: 179	http://www.anti-trojan.net/en/home.aspx