Trojan horse question
Tuesday, November 23, 2004 by dabe | Discussion: WinCustomize Talk
I need to appeal to any one of you computer geek guru types. 
I have a friend with a trojan called "downloader.small.12.bj". She's run AVG, which highlights the program, but won't get rid of it. The only thing I found from a google search was a recommendation to delete the file where it is contained. But, that file is not deletable. Can anyone help with this? Any ideas? TIA
I have a friend with a trojan called "downloader.small.12.bj". She's run AVG, which highlights the program, but won't get rid of it. The only thing I found from a google search was a recommendation to delete the file where it is contained. But, that file is not deletable. Can anyone help with this? Any ideas? TIA
Chris TH
Reply #2 Tuesday, November 23, 2004 8:34 PM
Reply #2 Tuesday, November 23, 2004 8:34 PM
It probably not deleteable because it's still running and so the file is locked. You'll need to kill the process itself before you can delete the file(s).
If the trojan is worth it's salt
it will not let you start up the windows task manager (which you would normally use). One of the earlier worm viruses (sasser or sobig?) did this.
I like to use the SysInternals process explorer in this case http://www.sysinternals.com/ntw2k/freeware/procexp.shtml
One other way is to boot the system from a CD or floppy and delete the file(s) on your HDD. This has it's own set of complications
If the trojan is worth it's salt
it will not let you start up the windows task manager (which you would normally use). One of the earlier worm viruses (sasser or sobig?) did this.I like to use the SysInternals process explorer in this case http://www.sysinternals.com/ntw2k/freeware/procexp.shtml
One other way is to boot the system from a CD or floppy and delete the file(s) on your HDD. This has it's own set of complications
dabe
Reply #3 Tuesday, November 23, 2004 8:41 PM
Reply #3 Tuesday, November 23, 2004 8:41 PM
Goodmorphing, what a great idea. It never occurred to me to turn off System Restore. We're trying it right now........... I hope it works. Thank you!
TheStranger22
Reply #4 Wednesday, November 24, 2004 7:39 AM
Ever notice how many people only read or hear what they want, it seems dabe is so excited he didn't see the downfall, nor the more complicated second solution that he should logically try first before doing a solution that has ramifications.
I do hope it works out for you dabe.
Reply #4 Wednesday, November 24, 2004 7:39 AM
| A lot of times a virus cannot be deleted because it is in the system restore. Some people advise turning that off if you are cleaning out a virus. Of course, you will lose all your restore points. |
| Goodmorphing, what a great idea. It never occurred to me to turn off System Restore. We're trying it right now........... I hope it works. Thank you! |
Ever notice how many people only read or hear what they want, it seems dabe is so excited he didn't see the downfall, nor the more complicated second solution that he should logically try first before doing a solution that has ramifications.
I do hope it works out for you dabe.
TheStranger22
Reply #5 Wednesday, November 24, 2004 7:46 AM
Reply #5 Wednesday, November 24, 2004 7:46 AM
Me bad.
Just looked up the virus on Symantec, advice just what you are doing. Turn off system restore, update virus software and delete.
Just looked up the virus on Symantec, advice just what you are doing. Turn off system restore, update virus software and delete.
Fuzzy Logic
Reply #6 Wednesday, November 24, 2004 7:46 AM
Reply #6 Wednesday, November 24, 2004 7:46 AM
The only thing I would add to #1 is to then start the computer in safe mode to do the cleaning.
Jafo
Reply #7 Wednesday, November 24, 2004 7:56 AM
Reply #7 Wednesday, November 24, 2004 7:56 AM
| Ever notice how many people only read or hear what they want, |
Like....dabe's a 'she' not a 'he'....
'Ramifications' of turning off 'system restore' to clear virii are approximately zero, as it is a common, necessary requirement for cleaning a system from infection.
Once a system is compromised by virus infection the priority is for its removal, not the retention of 'damaged' restore points.
dabe....if you can access the net [obviously you can]....dl and run Stinger.exe
http://vil.nai.com/vil/stinger/
...it'll sort out the more common virii/trojans.
Failing that, there's other online tools that can help....
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Tuesday, November 23, 2004 8:29 PM