Need some help snuffin' a Trojan

Strid

Relic Seeker
Adventurer
Joined
Feb 11, 2005
Messages
5,126
Age
41
Hey guys, last week some douchebag pulled a cute moveand stuffed a load of viruses into the new Bleach sub pack. I didn't scan them because they've been reliablefor over a year now. Anyway, I've got a computer that is so bad my ISP shut off my net because of it.

Anyone know a good way to get rid of this/these without havin' to completly erase my HD? That's actually not an option as I no longer have the materials to create a fresh BIOS.
 
What site did you get it from?
 
Not sure what site or if there is a site. It's not the subbed episode. It's the raw episode and the files necessary to make the sub it so no worries about gettin' it yourself. I had it forwarded to me in an E-Mail and it hit the guy who forwarded it to me as well.
 
That's why I download from Dattebayo. :awesome:
 
Anyone know a good way to get rid of this/these without havin' to completly erase my HD? That's actually not an option as I no longer have the materials to create a fresh BIOS.

1) BIOS isn't stored on the hard drive, those settings are integrated on a chip on your MB, so you shouldn't lose your BIOS settings at all when faced with formatting a Hard Disk.

2) Cleaning your PC might be feasible if you're scanning with things like Spybot S&D, an AV software with updated definitions, and the like. I'd recommend downloading the latest-and-greatest def files for all anti-malware programs from a different computer, saving to a thumbdrive, and loading those into the programs, then scanning (most programs allow for this, or should).

3) Running HijackThis and pasting the log into a future message might be some assistance, since it provides a readout of your registry and could highlight potentially infected areas which you could then remove. I cannot read through HJT logs, but I am certain there are those on this site who can.


Good luck :)
 
It would be much less hassle and alot easier to just download Damon's Boot & Nuke on a floppy or thumb drive, reboot your computer and have it boot off the disk, run it, grab yer restore disk and start back up. Takes maybe an hour.

Sure theres always the FFXI update but just do that overnight.

I never EVER recommend trying to stop trojans or other virus' once they start doing their thing. They're so picky and touchy that you never do get rid of the problem 100%
 
I never EVER recommend trying to stop trojans or other virus' once they start doing their thing. They're so picky and touchy that you never do get rid of the problem 100%

I tend to agree. I've only ever handled a virus removal by conventional means once. It was a cheap virus too, like the CoolWebSearch trojan or something, but even that was a pain in the ass to extract entirely.
 
As others said, best you can do is back up your important stuff and completely reinstall your computer system.

Viri, esp. trojans can be a real pain to remove entirely as some of them tend to dig themselves into a lot of (system) files and your registry.
 
I never EVER recommend trying to stop trojans or other virus' once they start doing their thing. They're so picky and touchy that you never do get rid of the problem 100%

Thirded, or fourthed, or whatever. A reformat is the best thing you can do to that system. If someone says they can take care of it, they've either got several days to devote to your computer, it's a very simple virus, or they're lying.
 
Thirded, or fourthed, or whatever. A reformat is the best thing you can do to that system. If someone says they can take care of it, they've either got several days to devote to your computer, it's a very simple virus, or they're lying.

Your last statement isn't that accurate.... except without internet access its fairly hard to get access to the web site that is needed to get the app or update it to current.
 
Your last statement isn't that accurate.... except without internet access its fairly hard to get access to the web site that is needed to get the app or update it to current.

What's so inaccurate about it?
 
What's so inaccurate about it?

I agreed with it.

The troubles required to remove a trojan or worm thats ran its course will very easily cost you more money and time than buying an external HDD to back up everything (which also takes time, but 1 night < 3-4 FULL days of digging) and reformat/reinstall drivers/games/internet browsers.

Idk, im tired right now, just reformat and call it a day. If you give me 4 hours i can have you a completely fresh system.

Speaking of which, I need to do that... laptop is getting clutterred.
 
I've done it before. There some pretty decent apps out there at removing the issues... Only problem is that if you cannot get to the internet you cannot fix it.

Edit: Also

or they're lying.

Your last statement.
 
Last edited:
The only applications I've seen that do a decent job on those issues are if the virus is either simple, or a widespread epidemic. I was under the impression we were talking about neither- as the PC in question is so cluttered up that its ISP had to be shut off. Granted, I could be wrong, if you want to enlighten me.

Lack of internet access doesn't prevent you from downloading something from a friend's house/library/whatever, sticking it on a $5 flash drive, and taking it to the infected system.
 
I've seen more than a handful of virus removal programs not actually remove the virus, I always use a scanner than remove whatever is left over manually.

Its a tedious process but can be done in one sitting if you know what you are doing. A Hi-Jackthis log would be very helpful in showing what files/entries are bad and what ones are supposed to be there.

If you want the quick fix, backup important data (be careful not to copy any infected files) and restore windows. You can also backup your FFXI folder from the root of program files. Once OS is reinstalled just copy FFXI folder back to program files and add 2 registry keys. I can give you the keys in text form or show you how to make a batch file to do it for you.

Easy way to backup is to make another partition on your hard drive then move important data to it. Reinstallation of windows will only erase the partition windows is installed on and leave your new partition alone. Once you are back on the net, make sure to scan the new partition before using any data on it.

On a side note, after clean install...go to EVERYTHING on your computer/net that has a password and change it. Email, FFXI, banking...anything. If your computer was bad enough for your ISP to shut you down (which I have never heard of) then you most likely were being used as a bot or whatnot and any personal info on your computer can be considered compromised. Not to mention what a keylogger could have gotten.
 
1) BIOS isn't stored on the hard drive, those settings are integrated on a chip on your MB, so you shouldn't lose your BIOS settings at all when faced with formatting a Hard Disk.

Yeah, I couldn't remember about this. I've only had to re-format once in my entire life so I couldn't remember what all I had to do but I remember havin' troubles with my BIOS file for some reason after I re-formatted.

2) Cleaning your PC might be feasible if you're scanning with things like Spybot S&D, an AV software with updated definitions, and the like. I'd recommend downloading the latest-and-greatest def files for all anti-malware programs from a different computer, saving to a thumbdrive, and loading those into the programs, then scanning (most programs allow for this, or should).

I did this but it only took out a small few things. I found and removed the files blockin' my anti-virus programs but everytime I ran them they didn't work right. I installed fresh ones and they got corrupted as well.



Thanks for all the suggestions guys. Sorry I didn't think you all sooner. I've been a bit pre-occupied and forgot I made this thread. After a bit of research I found out the virus did not come from the E-Mail, like I thought. I still have no clue where it came from, I got it on this computer too but was preparred for it. It seems to kick in whenever I visit anilinkz.com, but not every time. I've used that site for years and this is the first time I've encoutered problems. I've tested it on this computer and two out of six visits gave me the junk. So I dunno what is causin' it but I do know what it is, on my third computer I never get it. Google "AntiVirus Pro 2009" and it all becomes clear, except how to get it because it doesn't require a download or anything it just happens. What happens when I get it is I'll prep a video for view then recieve a system re-boot. When my system comes back up I've got AntiVirus Pro 2009. That's not the real problem though, it's a phony, though it fakes as a Windows program and tells you other wise, until you run the uninstall file. If you try to uninstall it rather than manually remove all of the files it has on your computer, then you get the nasties, it also does uninstall AVP 2009 just leaves you some presents in return. In the beginning all it is, is a nice lookin' scheme that tells you, you have junk on your computer you really don't in hopes you'll buy the full product, which also doesn't work, just a scam.

On my main computer I deleted the things blockin' my "boot from disk" and re-format options, a nice little screen saver file that runs from the time you press the power until you remove it or shut-down, and decided to do a re-format because it severly corrupted Windows and my very good PC runs like a bike made in the 80's with a rusted chain anda flat tire. Good thing I no longer play MMORPGs or I would be sweatin' the update times a few of you mentioned.

Thanks again for the adivce all, much appreciated.
 
Hmmm. My computer was recently hit with this Malware. I read through that article you linked Tristam, and thats amazing (in a scary way). I now understand why I get the "Windows Security Center" saying my automatic updates are not working. Its a frigging fake. It leads you to believe that something in your system is not working. This is crazy.

The wierd part about it though, is that in the article it showed two security centers. The fake and original, in which the fake said "Windows Security System" and the regular just says "Security System". Well, for some reason I could not find the fake one anywhere, except in the tray icons. Even wierder, the "Security System" in the Control Panel seemed to be a fake as well. It must be an updated form of the malware? I'm not sure.

Anyways, anytime I opened up this security center, AVG (Its the firewall and anti-virus program I have on this PC) would go crazy with detecting bad files in the SYSTEM32 folder. Ofcourse I would have AVG delete these files, but for some reason they kept coming back in the folder under different file names. Well the reason they would keep coming back is because the stupid fake "Windows Security Center" was still in the System Tray Icons. Well me and my family weren't aware that this was indeed fake, so we would open it up. Apparently everytime this is opened it plants the files in your SYSTEM32 folder no matter what. This was made obvious because AVG would detect the bad files everytime it was opened.

Unfortunately the only fix I have found so far is to ignore this fake "Windows Security System". As long as that isn't opened it doesn't plant the nasty files into my system. I am trying to find out where the program lies though. (Without having to reformat HDD)
 
Sketch, here are the filesI needed to get rid of. If you got hit by the same thing I did, then this will work. Not all of the files may be present but delete what you can, manually, and go from there.

Make sure you kill the registry processes first, if you can, or if they are even runnin'. Also where you see "Bleeping" that'll be the name of the computer, in my case "D_Kirk", in your case, whatever the name of your main user file is.

Associated Antivirus Pro 2009 Files:

c:\Program Files\AntivirusPro2009
c:\Program Files\AntivirusPro2009\AntivirusPro2009.cfg
c:\Program Files\AntivirusPro2009\AntivirusPro2009.exe
c:\Program Files\AntivirusPro2009\AVEngn.dll
c:\Program Files\AntivirusPro2009\htmlayout.dll
c:\Program Files\AntivirusPro2009\pthreadVC2.dll
c:\Program Files\AntivirusPro2009\Uninstall.exe
c:\Program Files\AntivirusPro2009\wscui.cpl
c:\Program Files\AntivirusPro2009\data
c:\Program Files\AntivirusPro2009\data\daily.cvd
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll
c:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll
c:\Documents and Settings\Bleeping\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Desktop\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009\AntivirusPro2009.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\AntivirusPro2009\Uninstall.lnk
c:\WINDOWS\dyxad.bat
c:\WINDOWS\gutysolyk.dll
c:\WINDOWS\oheva._dl
c:\WINDOWS\uhuleko.bat
c:\WINDOWS\ulysi.bin
c:\WINDOWS\votadiboz.sys
c:\WINDOWS\xocorepen.lib
c:\WINDOWS\system32\_scui.cpl
c:\WINDOWS\system32\mehydohahe.scr
c:\WINDOWS\system32\owah.bat
c:\WINDOWS\system32\uquhoti.reg
c:\WINDOWS\system32\zuxeme._dl
c:\Program Files\Common Files\buryleto.dll
c:\Documents and Settings\All Users\Application Data\cyqi.sys
c:\Documents and Settings\All Users\Application Data\gemegiqyno.ban
c:\Documents and Settings\All Users\Application Data\pisijupag.dll
c:\Documents and Settings\All Users\Application Data\pymom.lib
c:\Documents and Settings\All Users\Application Data\wivodexy.reg
c:\Documents and Settings\All Users\Application Data\yzotuxeka.vbs
c:\Documents and Settings\Bleeping\Application Data\ydutufuj.inf
c:\Documents and Settings\Bleeping\Local Settings\Application Data\coziguduca._sy
c:\Documents and Settings\Bleeping\Local Settings\Application Data\fapeka._dl
c:\Documents and Settings\Bleeping\Local Settings\Application Data\gukusozy.sys
c:\Documents and Settings\Bleeping\Local Settings\Application Data\iluqopohaz.ban


Associated Antivirus Pro 2009 Windows Registry Information:

HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusPro2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntivirusPro2009
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Pro 2009"
 
Back
Top