I hate asking it but i need help getting rid of a trojan

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Dirty F
    Too lazy to set a custom title
    • Jul 2001
    • 59204

    #1

    I hate asking it but i need help getting rid of a trojan

    1: I normally dont get infected
    2: Im usually the person who know how to clean other peoples computer.

    But im stuck with this highly annoying trojan which wont go away.
    AVG and Panda online scan cant get rid of it.

    AVG finds the infected file, heals it but it keeps coming back. Even when i manually delete the infected/healed file.

    Its the trojan backdoor.midrug.b. It creates a file called msrss32.dll in the windows/system32 dir every time i reboot. Ofcourse i deleted that file but it just keeps appearing. It opens something in the background which spoofs an internet explorer page when checking what programs are running. This is the part where it opens a port i guess.

    Anybody any clue? The problem is google shows nothing about the trojan.
  • .:St Ides:.
    Confirmed User
    • Jul 2004
    • 4857

    #2
    slowly roll it down off your cock, then set in gently into a garbage can

    Comment

    • GoLiaT
      Confirmed User
      • Mar 2002
      • 1130

      #3
      check the Prefetch dir
      probably have a file there that keeps loading it into the ram
      "where ever you go..there you are."

      Comment

      • The Other Steve
        Confirmed User
        • Dec 2001
        • 2106

        #4
        Download the trial version of Kaspersky - kaspersky.com - you might find that gets rid of it.

        We've run AVG and Panda and they have missed a lot of stuff that Kaspersky has found and healed.
        Left intentionally blank ... just like my brain

        Comment

        • loverboy
          When it rains, it pours
          • May 2003
          • 20609

          #5
          House Call (Trend Micro)

          http://housecall.trendmicro.com/hous...start_corp.asp

          Comment

          • eiht_98
            Confirmed User
            • Jan 2001
            • 6103

            #6
            turn system restore off in windows..restart...delete the file...restart again and tunr system restore on...I hope it will work

            Comment

            • Dirty F
              Too lazy to set a custom title
              • Jul 2001
              • 59204

              #7
              Thanks will check it out.

              Comment

              • SmokeyTheBear
                ►SouthOfHeaven
                • Jun 2004
                • 28609

                #8
                A good tip when tracking down bad files is to view common windows directories by date and see n programs..

                use the search function and search for exe files created within the last few days..
                hatisblack at yahoo.com

                Comment

                • KRosh
                  So Fucking Outlawed
                  • Nov 2001
                  • 5114

                  #9
                  Try using
                  Spy Sweeper
                  ICQ 115433750

                  Comment

                  • OzMan
                    Confirmed User
                    • Sep 2003
                    • 9162

                    #10
                    I found the backdoor.midrug.a variant listed on some foreign sites.

                    This Chinese site says their anti-virus shareware program will fix it. (The "a" variant that is)

                    Hopefully the program menus aren't in Chinese though

                    Comment

                    • C_U_Next_Tuesday
                      WW4L
                      • Oct 2002
                      • 10581

                      #11
                      I have the same thing...and nothing has worked.. it wont even let my system resotre work..so its c/format for me. I am just getting all my "stuff" on cd's and getting my programs in order.

                      this thing is nuts..

                      Comment

                      • Doctor Dre
                        Too lazy to set a custom title
                        • Jan 2001
                        • 51692

                        #12
                        I have a computer infected with that too . I gotta format it anyways it's full of crap
                        Originally posted by rayadp05
                        I rebooted, deleted temp files, history, cookies and everything...still cannot view the news clip. All I see is that fucking gay ass music video from "Rick Roll". Anyone else have a different link to the news clip?

                        Comment

                        • Shags
                          Confirmed User
                          • Mar 2004
                          • 735

                          #13
                          Last edited by Lensman on 11-02-2004 at 05:40 PM
                          Last edited by SmokeyTheBear on 11-02-2004 at 05:51 PM


                          They really are the same person.
                          Click Here

                          Comment

                          • rayzor
                            Confirmed User
                            • Dec 2002
                            • 245

                            #14
                            the trojan is most likely loaded in memory.. drop down to safe mode and delete the dll. if that doesnt help get a program called hijack and see what else is loaded in memory.
                            Skype: uws.ray

                            Comment

                            • OzMan
                              Confirmed User
                              • Sep 2003
                              • 9162

                              #15
                              Originally posted by rayzor
                              the trojan is most likely loaded in memory.. drop down to safe mode and delete the dll. if that doesnt help get a program called hijack and see what else is loaded in memory.
                              http://www.spychecker.com/program/hijackthis.html

                              Comment

                              • pradaboy
                                sell me your banners
                                • Dec 2003
                                • 12931

                                #16
                                maybe it changed something in your registry?

                                I'd recommend PestPatrol for anything spyware/backdoor/trojan it finds everything and deletes it too.

                                dunno if spending $$$ on all that software is usefull for just this one case.
                                Media Buyer - Sell me your traffic!
                                FREE to register domains...
                                Better than 99% of the crap sold here!

                                Comment

                                • SpeakEasy
                                  Confirmed User
                                  • Sep 2002
                                  • 2681

                                  #17
                                  just format and it's all good again.
                                  Check Your Internet Speed;
                                  http://www.speakeasy.net/speedtest/

                                  Comment

                                  • Holly
                                    Too lazy to set a custom title
                                    • Jun 2003
                                    • 10017

                                    #18
                                    Many times system restore is your enemy when you're trying to clean your computer. Always disable it first.
                                    War National Damn Champions Eagle

                                    Comment

                                    Working...