Trojan horse

[Dogwatch]

My computer tells me that I have got a Back door Blarul C trojan horse in C\system volume information\restore-follwed by a load of numbers and letters-.exe.

I have run Norton, AVG anti virus, downloaded some trojan horse removers etc.

None of them show a virus or trojan in the system but every time I start up it runs the message as above.

Any ideas please, ready to throw the lot out of the window.

Terry

[El Prez]

Try going to your nearest PC World helpdesk/workstation and asking them if they can produce a CD from their own PCs. They did it for me and it cleared my last prob which appeared post servicing! It pays for them to help prospective customers.

[goldie ex rmp]

Try out 'Trojan remover' 30 day trial: -


http://www.simplysup.com/tremover/download.html

[Guest]

Yep I have had the same for two weeks now, my system restore tells me there is no Trojan Horse but my AVG and Norton tell me there has been.

I have tried Symantec download that tells me I haven't got a virus but emails bounce telling me I have.

If you think that is bad, they have even got into Google today with MyDoom bug

http://news.bbc.co.uk/1/hi/technology/3927963.stm

[El Prez]

Read and do what it says on the tin

Oh dad, you're always making us do it the hard way.................doh!

[El Prez]

Stix, does it make it easier for infiltrators to get into your pooter if you fileshare online as you do for music?

[goldie ex rmp]

Stix, does it make it easier for infiltrators to get into your pooter if you fileshare online as you do for music?

if you keep your anti virus updated........and you must...........when and if you download from the likes of kaaza your download should stop as soon as your anti virus spots it, im not saying that i do it as its a little naughty but my pc cillin anti virus does just that when i start downloading in my sleep "your honour".
kaaza is full of viruses and trojans so be careful

[Guest]

Trojan Horse Downloader Small 7 AV this is what I have in a music file (Strange as I do not download music!) it says it cannot be healed but when I run an AVG scan on it , it shows no virus detected.

So whats up Doc?

[Dogwatch]

Currently running a virus check with system restore disabled, now starting to think that a full restore C is the easiest way to get rid of this problem. Any thoughts?

[Ploggers]

Try this first;

http://securityresponse.symantec.com/av ... larul.html. If you follow those instructions then it should work. Failing that then get ready for a crash course in advanced "pc f@#k about with"


Not the easiest thing to do unless you have good it skills but here's what you do;

TURN OFF SYSTEM RESTORE

Do an online scan with Trend AV http://housecall.trendmicro.com/houseca ... t_corp.asp

Make a note of all the files etected as "BKDR_BLARUL.A"

Then you need to remove the malware program that carries this thing, to do this..

CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs, locate the malware file or files detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.


This virus autostarts on boot-up so you need to remove it from the registry - BE CAREFUL NOT TO DELETE ANYTHING ELSE OR YOU WILL f@#k UP YOU PC!!

Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the right panel, locate and delete the entry or entries:
Search for "blss.exe"
If you find an entry, delete it and then press F3 to continue.
Delete all entries
Repeat search just to be sure
Close Registry Editor.

NB: you do not need BLSS.exe, it's a dialer. If it's not there then the virus cant attach itself to the executable file.


Check add/remove programs in control panel. If there is a program called "Shield" uninstall is as this is part of the malware program.

[Guest]

Plogs
Too dodgy, I'll just let the little bleeder sit in a music file until I get my PC health check next January and let someone else get rid rid of it, it seems to be isolated anyway.

[goldie ex rmp]

Plogs
Too dodgy, I'll just let the little bleeder sit in a music file until I get my PC health check next January and let someone else get rid rid of it, it seems to be isolated anyway.

Wise move lol