Backdoor.Trojan

Hi, Everyone I need some help, what do I do when norton can't delete a virus.John Reagon

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

RE: Backdoor.Trojan, loconut, Jul-18-04, 01:14 PM, (1) RE: Backdoor.Trojan, MSTS_Country, Jul-18-04, 02:34 PM, (2) RE: Backdoor.Trojan, loconut, Jul-18-04, 02:41 PM, (3) RE: Backdoor.Trojan, sinclair97, Jul-18-04, 03:13 PM, (4) RE: Backdoor.Trojan, MSTS_Country, Jul-18-04, 03:22 PM, (5) RE: Backdoor.Trojan, bnsf1959, Jul-18-04, 03:30 PM, (6) RE: Backdoor.Trojan, MSTS_Country, Jul-18-04, 03:41 PM, (7) RE: Backdoor.Trojan, sinclair97, Jul-18-04, 04:00 PM, (8) RE: Backdoor.Trojan, MSTS_Country, Jul-18-04, 04:07 PM, (9) RE: Backdoor.Trojan, sinclair97, Jul-18-04, 05:14 PM, (10) RE: Backdoor.Trojan, bnsf1959, Jul-18-04, 05:15 PM, (11) RE: Backdoor.Trojan, loconut, Jul-18-04, 06:18 PM, (12) RE: Backdoor.Trojan, MSTS_Country, Jul-18-04, 08:47 PM, (13) RE: Backdoor.Trojan, rpicardi1, Jul-19-04, 06:47 AM, (14)

Conferences | Topics | Previous Topic | Next Topic

At Mcafee website you can get a program called stinger which will search and destroy most of the latest worms and trojans-
http://www.mcafee.com
and look for the latest "stinger.exe"Joe

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Can you link me? cause I can't find it.John

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Here it is
http://vil.nai.com/vil/stinger/

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

John,If you have Windows XP, you should be able to use System Restore. you can also activate Windows XP own firewall by going into Control panel/Network connections, and then right-clicking on the active connection which opens the Properties box, and from there you click the Advanced tab and check the little box where it say protect my computer from the internet etc. Can you send us a screenshot of your active processes. Again if you have Windows XP Ctrl+alt+Del and click the Processes tab. Cos one of them babies is a Trojan.Mike

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

The computer is fine so far I started the "stinger.exe" to see if it can wipe out the virus,also I did what you said mike ,but which one is the one in the Processes Tab.John

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

>The computer is fine so far I started the "stinger.exe" to
>see if it can wipe out the virus,also I did what you said
>mike ,but which one is the one in the Processes Tab.
>
>John It says "Processers" right next to "Applications" when you press Ctrl-Alt-Del.Ken Plaza

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Thank you, also how do you use stinger.exe I hit scan but how do i delete the virus?John Reagon

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I have never used the stinger so i wouldn't know, but you can help by answering the following questions:1.What operating system you have?2. What kind of anti-virus you have, and if any was it deactivated when you got infected?3. Was it a trojan or a virus that infected your system?4. How did you know that you were infected?Mike

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

1. Windows XP.2. Norton AntiVirus.3. Trojan (Backdoor.Trojan) really I don't konw if its a virus.4. Norton AntiVirus has detected a virus on your computer.

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

Hi John,Windows XP is good news. I'll come back to that later, but first I must ask:
1. Why you can't let Norton anti-virus do a scan of its own. It will locate and quarantine the virus--if it indeed is a virus. 2. Did you have the anti-virus switched on?3. What version of norton's anti-virus do you have ?If it is a Trojan could you write down all the active process in the way shown to you, but first switch the computer off and then bootup, then count the processes.After you have done that use System Restore, and repeat the active processes list count. if there is one missing from the list, then an executable has been deleted in the Restore changes, and that executable would have been the Trojan. This is the way I removed my trojan when I had inadvertantly switched my "FIREWALL" off.One more thing to do John whenever you go onto the net you must have a firewall activated, and the good news is that you have one already on your XP system:1. Go to Control panel2. Click on Network connections.3. right-click on your active connection (indicated by two little illuminated blue computer screens).4. Click on the Advanced tab in the Properties box that appears.5. Put a checkmark in the little blank box right next to where it says: "Protect my computer from the internet accessing my computer etc.6. Click OK.7. you should now see those two tiny illuminated blue computer screens with a tiny padlock symbol or icon in the top right-hand corner.
That's all I can do for you, but let us know how get on Mike

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Jul-18-04 AT 05:17 PM (EST)

http://securityresponse.symantec.com/ Go here to Norton's website and you'll be able to find some answers.Ken Plaza

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Jul-18-04 AT 06:20 PM (EST)

"how do you use stinger.exe"?
Stinger automatically deletes anything it finds, John-If you let it scan and still have the problem, then you need to look for other solutions.Joe

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

I let norton let it scan the whole computer. it can't doing anything about it. And Stinger can't delete it either, anyother help.John Reagon

Alert | IP

Printer-friendly page | Edit | Reply | Reply With Quote | Top

LAST EDITED ON Jul-19-04 AT 07:44 AM (EST)

"The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.Disable System Restore (Windows Me/XP).
Update the virus definitions.
Run a full system scan and delete all the files detected as Backdoor.Trojan.
Delete the value that was added to the registry"First of all, disable System Restore. Worms and viruses will reinfect the computer from there and no antivirus scan is capable of removing infections from the System Restore folder.Next, restart the computer in safe mode and do a virus scan. If that doesn't work, go to the Symantec web site, you have to leave Safe Mode to access the Internet, look up the name of the offending trojan, (You might have to use a clean computer if the trojan blocks the visit,) and print out the removal instructions.Some of this stuff is woven in the registry so tight that careful hand removal in safe mode, or format C, reinstall everything, are the only way you can remove them. (Or Ghost restore of C if the infection occured since your last backup of C.)Here is the link to the removal instructuins, (assuming that the name of the program is indeed Backdoor.Trojan.)
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.trojan.htmlThis bad boy is really tangled into the registry settings and all the damage there has to be corrected by hand.SRV Ron

Alert | IP

[ Home | MSTS Forum | MSTS FAQ | How To... | File Library ] Copyright © 2004 by Nels Anderson. All Rights Reserved.