Computing.Net > Forums > Security and Virus > Need Help To Defeat a Trojan

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Need Help To Defeat a Trojan

Reply to Message Icon

Name: NickF
Date: March 26, 2009 at 16:41:55 Pacific
OS: Microsoft Windows XP Professional
CPU/Ram: 2.999 GHz / 3582 MB
Product: Custom / CUSTOM
Subcategory: Viruses
Comment:

I have been struggling with a trojan for two days now. I would normally just reinstall a fresh copy of windows but the virus really got a hold into my computer. Here are the symptoms:
I cannot paste anything (copy =>paste will not not for anything, files or text)
Windows Explorer has reverted to classic style, All other themes have been deleted.
The task bar doesn't show up when I start my computer, I can see the top of it but cannot drag it up to make it visible. It is not locked. I can make it visible by getting to the task bar properties checking then unchecking "Show Quick Launch". Also no programs running show up on the task bar.
I cannot install Windows SP3, which might fix the problems, but everytime I try it has a Cryptography error.
I cannot start any services (hence the cryptography error) when I do try and start it says missing needed files, or something along those lines.
I am unable to install many programs, I tried to install: Malwarebytes' Anti-Malware, since I read on a site that it might help. When I try to run it,it says "Failed to load control Vbalgrid, from vbalsgrid6.ocx, and it goes on from there.

I have Kaspersky Anti-Virus running, which found it when it was running gave me the option to stop, which I said stop and quarantine, but it still managed to load.
I would copy and paste the log but paste doesn't work(see above)
The virus infected the files:
system32\winlogon.exe
system32\dllcache\user32.dll
system32\user32.dll
system32\svchost.exe
system32\services
sustem32\lsass.exe
system32\spoolsv
explorer.exe

Kaspersky recognized the virus as: Trojan.Win32.patched.aa
Trojan.Win32.patched.bb
Trojan-Downloader.Win32.Agent.lyb


As Well as tons of registry values

I had a old backup of the registry which I used to fix the registry values.
Also, I used windows recovery tool to copy all of those files from the servicepackfiles folder to replace the files corrupted.
However all of my attempts have lead me nowhere.

I am looking for any suggestions on what anyone thinks should be done.
Thank you for your time,
Nick



Sponsored Link
Ads by Google

Response Number 1
Name: LuKeJ
Date: April 8, 2009 at 06:11:19 Pacific
Reply:

Hi,

collect a SVCHOST.exe from a working XP computer with the same service pack.

Reboot the problematic computer in safe mode (F8 during boot) and replace SVCHOST.exe with the one previously collected.

Then reboot in normal mode, and repeat a full scan of your system with an updated antivirus software.

Good luck ;)

--LuKe


0

Response Number 2
Name: NickF
Date: April 8, 2009 at 07:22:16 Pacific
Reply:

Hey,
Thanks for the reply. I actually already tried something like that. I used Windows recovery tool to replace my SVChost/explorer/winlogon/plus a few others with copies from my CD. This however did not work. I think it had some kind of start-up script that corrupted the files every time windows started.
I actually ended up fixing the problem by doing a repair install of windows and that fixed 95% of the problems.


0

Sponsored Link
Ads by Google
Reply to Message Icon

Related Posts

See More







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Need Help To Defeat a Trojan

Need help to check my computer www.computing.net/answers/security/need-help-to-check-my-computer/24004.html

How to deveop a Trojan Hourse www.computing.net/answers/security/how-to-deveop-a-trojan-hourse/5105.html

Need help with trojan horse www.computing.net/answers/security/need-help-with-trojan-horse/12455.html