 |
|
|
|
Next: Troj/Zlob-ZG reported on my machine.....
|
| Author |
Message |
External
Since: Feb 22, 2007
Posts: 6
|
(Msg. 1) Posted: Thu Feb 22, 2007 7:42 pm
Post subject: Trojan Stuck in registry, System Restore Unavailble
Archived from groups: alt>comp>virus (more info?)
|
|
|
Hiho,
I have a Trojan. Packed. 9 and other spyware trapped in my WinXP
registry and I can't get it out. It is intefering with my IE as well
as all my other online programs (AOL, gaming, etc). Norton and
SpyDoctor do nothing. Will a registry cleaner solve my problems? Or
should I just reinstall WinXP?
Also, I can't set my system back to a prior date with System Restore.
Nope, uh uh, won't let me, I hit the keys on the calendar, and they do
nothing.
Some files I wrote down:
Trojan: C:\ Documents and Settings: gulpxc [1]. htm
C:\rawpy.exe
C:\ybaxd.exe
Any info would be greatly appreciated.
Ivy |
|
| Back to top |
|
 | |
|
Ayatollah Yootweiss Al-Re
|
External
Since: Jan 24, 2007
Posts: 27
|
(Msg. 2) Posted: Fri Feb 23, 2007 4:11 am
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
In article <1172202148.424668.309390
@p10g2000cwp.googlegroups.com>, ivyliege.TakeThisOut@aol.com says...
> Hiho,
>
> I have a Trojan. Packed. 9 and other spyware trapped in my WinXP
> registry and I can't get it out. It is intefering with my IE as well
> as all my other online programs (AOL, gaming, etc). Norton and
> SpyDoctor do nothing. Will a registry cleaner solve my problems? Or
> should I just reinstall WinXP?
>
> Also, I can't set my system back to a prior date with System Restore.
> Nope, uh uh, won't let me, I hit the keys on the calendar, and they do
> nothing.
>
> Some files I wrote down:
>
> Trojan: C:\ Documents and Settings: gulpxc [1]. htm
>
> C:\rawpy.exe
>
> C:\ybaxd.exe
>
> Any info would be greatly appreciated.
>
> Ivy
>
>
Try downloading AntiVir, then booting into Safe Mode to do the
install and scan. Often works for us.
--
If you don't want the whelks don't muck 'em about
If you don't want them someone else may |
|
| Back to top |
|
| |
External
Since: Jul 04, 2003
Posts: 1752
|
(Msg. 3) Posted: Fri Feb 23, 2007 11:54 am
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
From: "wltdnfaded"
| Hiho,
| I have a Trojan. Packed. 9 and other spyware trapped in my WinXP
| registry and I can't get it out. It is intefering with my IE as well
| as all my other online programs (AOL, gaming, etc). Norton and
| SpyDoctor do nothing. Will a registry cleaner solve my problems? Or
| should I just reinstall WinXP?
| Also, I can't set my system back to a prior date with System Restore.
| Nope, uh uh, won't let me, I hit the keys on the calendar, and they do
| nothing.
| Some files I wrote down:
| Trojan: C:\ Documents and Settings: gulpxc [1]. htm
| C:\rawpy.exe
| C:\ybaxd.exe
| Any info would be greatly appreciated.
| Ivy
Trojans don't exist in the Registry. The Registry points to a DLL, EXE or other extension
based file and the OS interprets the Registry and loads it accordingy to the type of
Registry entry it is located in. Therefore, Trojans don't get stuck in the Registry.
Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close
Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.
C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm
Additional Instructions:
http://pcdid.com/Multi_AV.htm
* * * Please report back your results * * *
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm >> Stay informed about: Trojan Stuck in registry, System Restore Unavailble |
|
| Back to top |
|
| |
External
Since: Feb 22, 2007
Posts: 6
|
(Msg. 4) Posted: Sat Feb 24, 2007 5:06 pm
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
On Feb 23, 6:54 am, "David H. Lipman"
wrote:
> From: "wltdnfaded"
>
> | Hiho,
>
> | I have a Trojan. Packed. 9 and other spyware trapped in my WinXP
> | registry and I can't get it out. It is intefering with my IE as well
> | as all my other online programs (AOL, gaming, etc). Norton and
> | SpyDoctor do nothing. Will a registry cleaner solve my problems? Or
> | should I just reinstall WinXP?
>
> | Also, I can't set my system back to a prior date with System Restore.
> | Nope, uh uh, won't let me, I hit the keys on the calendar, and they do
> | nothing.
>
> | Some files I wrote down:
>
> | Trojan: C:\ Documents and Settings: gulpxc [1]. htm
>
> | C:\rawpy.exe
>
> | C:\ybaxd.exe
>
> | Any info would be greatly appreciated.
>
> | Ivy
>
> Trojans don't exist in the Registry. The Registry points to a DLL, EXE or other extension
> based file and the OS interprets the Registry and loads it accordingy to the type of
> Registry entry it is located in. Therefore, Trojans don't get stuck in the Registry.
>
> Download MULTI_AV.EXE from the URL --http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in Normal Mode.
> This way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files or you can
> download the files and perform a scan in Normal Mode. Once you have downloaded the files
> needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> file. http://www.ik-cs.com/multi-av.htm
>
> Additional Instructions:http://pcdid.com/Multi_AV.htm
>
> * * * Please report back your results * * *
>
> --
> Davehttp://www.claymania.com/removal-trojan-adware.htmlhttp://www.ik-c...om/got-
Hi Dave,
No, it didn't work. It did delete some trojans, but the Norton pop-ups
still occur and then my IE stops working. Would it just be bet5ter if
I backed everything up and just reinstalled?
Ivy >> Stay informed about: Trojan Stuck in registry, System Restore Unavailble |
|
| Back to top |
|
| |
External
Since: Jul 04, 2003
Posts: 1752
|
(Msg. 5) Posted: Sun Feb 25, 2007 1:22 am
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
| |
External
Since: Feb 22, 2007
Posts: 6
|
(Msg. 6) Posted: Sun Feb 25, 2007 11:13 am
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
| |
External
Since: Jul 04, 2003
Posts: 1752
|
(Msg. 7) Posted: Sun Feb 25, 2007 7:20 pm
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
| |
External
Since: Feb 22, 2007
Posts: 6
|
(Msg. 8) Posted: Wed Feb 28, 2007 6:35 am
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
|
|
| Back to top |
|
| |
External
Since: Oct 14, 2007
Posts: 190
|
(Msg. 9) Posted: Wed Feb 28, 2007 4:04 pm
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
Use Spyerase version 10, it's fast and free. It now has over 1700 signatures
to remove All variants of Virusburst, Spy sheriff and Antivermins. New
Feature, Spyerase
will now update your hosts file. This tool is designed to Specifically
remove all variants.
Scan time is about 2 minutes. Designed for Windows 2000/XP only. Password is
still required.
First read this page http://www.pcbutts1.com/downloads then download
Spyerase from here http://www.pcbutts1.com/downloads/spyerasesetup.zip
Check my feedback and see what others have said about it
http://pcbutts1-therealtruth.blogspot.com/
Feedback is very important to the development of Spyerase.
Let me know how it works. Send feedback here
http://pcbutts1-therealtruth.blogspot.com/
--
Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell
"wltdnfaded" wrote in message
> On Feb 25, 2:20 pm, "David H. Lipman"
> wrote:
>> From: "wltdnfaded"
>>
>> |
>> | Thank you, Dave. I will try these. Thanks for your help, appreciate
>> | it. 
>>
>> You're welcome.
>>
>> --
>> Davehttp://www.claymania.com/removal-trojan-adware.htmlhttp://www.ik-c...om/got-
>
> Well, nothing worked. It's SpySheriff. I've tried everything-- it just
> keeps replicating throughout the system. It doesn't show up in
> programs or the registry by the name SpySheriff, and I can't find the
> typical files that accompany it, ie winstall. Honestly, I've spent
> almost a week on this-- wouldn't it just be easier to back up files
> and wipe the hard drive?
>
> Ivy
> >> Stay informed about: Trojan Stuck in registry, System Restore Unavailble |
|
| Back to top |
|
| |
External
Since: Jan 01, 2007
Posts: 4
|
(Msg. 10) Posted: Wed Feb 28, 2007 7:18 pm
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
pcbutts1 wrote:
> Use Spyerase version 10, it's fast and free. It now has over 1700 signatures
> to remove All variants of Virusburst, Spy sheriff and Antivermins. New
> Feature, Spyerase
CAUTION !!
PCBUTTS1 Troll Alert
Do not use is plagiarized software -- be warned -- be smart !
This is the REAL PCBUTTS1 content, Foul material:
{ Caution adult material below }
http://www.pcbutts1. com/downloads/mpv.htm
http://www.pcbutts1. com/downloads/max.htm
http://www.pcbutts1. com/downloads/license.htm
http://www.pcbutts1. com/rlk/rlk.htm
http://www.pcbutts1. com/downloads/meatplow.htm
http://www.pcbutts1. com/downloads/pervert.htm
http://www.pcbutts1. com/downloads/wtcpcb.htm
The truths are...
- PCButts1 is a consummate liar.
- PCButts1 is not and has never been a Microsoft MVP. All MVPs are
registered with Microsoft and Microsoft has indicated if PCButts1 had a
connection with the MVP program he would summarily be dismissed from the
program and that the information would be posted on the MVP web site.
PCButts1 can not prove he's the recipient of a MVP award nor will he
ever try to prove that he was awarded a MVP title because he simply can't.
- PCButts1 has stolen the code are/or utilities created by or worked on
by; Kelly, RACooper, Noahdfear, Miekiemoes, Swandog46, Winhelp2002,
Stuart and others.
- PCButts1 hosts pornographic and obscene material on his web site in
his slander attack of others.
- PCButts1 impersonates people on the Microsoft forums to get past the
fact he was banned by Microsoft from posting as himself. PCButts1 also
name shifts and uses numerous sock puppets such as Sharon Franks.
PCButts1 has also impersonated such people as Sharon F., PA Bear and
Leythos to discredit them.
- PCButts1 hosts no technical anti malware facts or materials on his
foul web site and only posts in forums to spam the Seedsv.Com web site.
- PCButts1 is a male and he is not a female as PCButts1 is trying to
falsely portray.
- PCButts1 has violated the intellectual property rights of software
creators and/or vendors by hosting their property on the PCButts1 web
site without their expressed permission and has done so even after they
have asked PCButts1 to remove them. PCButts1 then publicly lied stating
he was an authorized mirror when PCButts1 and his web site were never so
authorised.
Example: http://ccollomb.free.fr/unlocker/#faq
- Is this website "http://www.pcbutts1. com/" authorised to distribute
Unlocker? No it is not.
- PCButts1 searches the net for problem solutions and then posts those
solutions in forums and either infers he is the author or creator of
that information or outright states that he is the author or creator of
that information. Thus he is trying to benefit from another's hard work.
- PCButts1 has slandered the good names of several well known and
trusted anti malware authors or forum helpers. He says he is part of
the anti malware community but nobody in that community will recognise
him as such. Ask anyone in the anti malware community and see what they
say. >> Stay informed about: Trojan Stuck in registry, System Restore Unavailble |
|
| Back to top |
|
| |
External
Since: Jul 04, 2003
Posts: 1752
|
(Msg. 11) Posted: Wed Feb 28, 2007 10:24 pm
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
From: "wltdnfaded"
|
| Well, nothing worked. It's SpySheriff. I've tried everything-- it just
| keeps replicating throughout the system. It doesn't show up in
| programs or the registry by the name SpySheriff, and I can't find the
| typical files that accompany it, ie winstall. Honestly, I've spent
| almost a week on this-- wouldn't it just be easier to back up files
| and wipe the hard drive?
|
| Ivy
Two part reply..
Perform Part 1 then perform Part 2.
If the first two parts don't work, perform the alternate section.
It is suggested that you execute each tool in Normal Mode then in Safe Mode.
Part 1
-----------
Use noahdfear's SmitFraud, SpyAxe, SpyFalcon, et. al., removal tool -- SmitRem.exe
http://noahdfear.geekstogo.com/click%20counter/click.php?id=1
http://www.bleepingcomputer.com/forums/topic43659.html
Part 2
-----------
Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe
Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close
NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.
Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }
A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.
It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.
ALTERNATE:
S!ri's SmitfraudFix
http://siri.urz.free.fr/Fix/SmitfraudFix_En.php
Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.
* * * Please report back your results * * *
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm >> Stay informed about: Trojan Stuck in registry, System Restore Unavailble |
|
| Back to top |
|
| |
External
Since: Mar 01, 2007
Posts: 156
|
(Msg. 12) Posted: Thu Mar 01, 2007 11:20 pm
Post subject: Re: Trojan Stuck in registry, System Restore Unavailble [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)
|
|
|
"wltdnfaded" wrote in
> On Feb 25, 2:20 pm, "David H. Lipman"
> wrote:
>> From: "wltdnfaded"
>>
>> |
>> | Thank you, Dave. I will try these. Thanks for your help, appreciate
>> | it.
>>
>> You're welcome.
>>
>> --
>> Davehttp://www.claymania.com/removal-trojan-adware.htmlhttp://www.ik-c
>> s.com/got-a-virus.htm
>
> Well, nothing worked. It's SpySheriff. I've tried everything-- it just
> keeps replicating throughout the system. It doesn't show up in
It doesn't replicate...
You know, you should just go ahead and reformat, yes. Clearly if
spysherrif removal is too complicated for you, reformatting often should
be something you would get used to.
> typical files that accompany it, ie winstall. Honestly, I've spent
> almost a week on this-- wouldn't it just be easier to back up files
> and wipe the hard drive?
Sure thing.
--
Dustin Cook
Author of BugHunter - MalWare Removal Tool - V2.2
web: http://bughunter.it-mate.co.uk - email:
.removethis
Pad: http://bughunter.it-mate.co.uk/pad.xml >> Stay informed about: Trojan Stuck in registry, System Restore Unavailble |
|
| Back to top |
|
| |
| Related Topics: | Disabled registry from new trojan - I recently had my computer infected with four trojans due to them being new and undetected by the majority of anti-virus programs. So I submitted them to AVG who confirmed they were trojans and updated their virus definitions. This removed the four..
System Volume Information/trojan - My EZantivirus tells me I have a Trojan in this folder. When I do a scan of the folder there appear to be no files in it. Is it a real folder? I've tried to open it and Windows stops me. Rob Graham
A Trojan Horse in the System Volume Information Directory .. - I keep getting a window saying that there is a Trojan Horse in my System Volume Information directory (Windows XP). McAfee does not list this directory, and the AVG Antivirus program will not find it. How do I get rid of it? Thanks! lena
HELP Is SYSTEM.EXE spyware or a rougue dial-up ? - Have scanned computer using noton AV = Spybot - nothing found ! any idiea What function [ WINDOWS/SYTEM/ SYSTEM.EXE ] performs See ZONE ALARM LOG below SYSTEM.EXE is trying to connect to the Internet or your local network ZoneAlarm is asking you..
HELP Is SYSTEM.EXE spyware or a rogue dial-up ? - Have scanned computer using Norton AV ( in safe mode)& run= Spybot - nothing found ! any idiea What function WINDOWS/SYTEM/ "SYSTEM.EXE" ( OS Win 98se ]performs? See ZONE ALARM LOG below SYSTEM.EXE is trying to connect to the Internet o... |
|
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
|
|
|
FAQ
Search
Profile
Private Messages
Log in
