PC Review


Reply
Thread Tools Rate Thread

Trojan Horse Downloader

 
 
Lance Cook
Guest
Posts: n/a
 
      25th Jul 2004
hello all,
I've recently had a trojan in my system that is really
confusing me. I shut-off system restore, and rebooted
into safe-mode. I deleted the file through my Anti-Virus,
but when i restarted my pc the next day the same Trojan
was there again. It doesnt actually excute itself, but
the file downloads itself somehow. I've looked for
information on it but i cant find away to get rid of it
for good. Please help me. The name of it is Trojan horse
Downloader.Agent.AL. It's always
in "C:\Temp\BDL74125.exe". Thanks
Lance Cook

 
Reply With Quote
 
 
 
 
Jerry
Guest
Posts: n/a
 
      25th Jul 2004
Found this in a news group. Try this....thanks to Tellco. The program he
mentions is Hijack This! which can be found at http://www.merijn.org/.
-------------------------------------------------------------

Ok, first disable the System Restore feature in Windows XP (you can
re-enable it again once your system is clean). Here's a link on how to do
this:

http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

Next, make sure all browser and all Windows Explorer windows are closed,
then run "Hijack This!" and have it fix these entries:

O4 - HKLM\..\Run: [SPELL32V] C:\WINDOWS\System32\SPELL32V.exe

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download
Control Class) - http://www.fileplanet.com/fpdlmgr/c...DC_1_0_0_42.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) -
http://launch.gamespyarcade.com/sof...nch/alaunch.cab

When done, reboot your system and bring it up in "Safe Mode" (F5 or F8 when
starting Windows). At this point make sure Windows is configured to see
hidden files and folders. Here's a link on how to do this if needed:

http://service1.symantec.com/SUPPORT...&osv=&osv_lvl=

While in "Safe Mode", find these files and delete them from your system:

C:\Windows\bdlj4126.exe
C:\WINDOWS\System32\SPELL32V.exe

When finished, reboot your system again and bring it back up in normal mode.
Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG,
click on Start -> Run -> type in MSCONFIG -> click OK. Once everything is
enabled, run "Hijack This!" and post a new log to this thread so I can
verify that we got everything.

"Lance Cook" <(E-Mail Removed)> wrote in message
news:36cd01c471ec$f2ea7a10$(E-Mail Removed)...
> hello all,
> I've recently had a trojan in my system that is really
> confusing me. I shut-off system restore, and rebooted
> into safe-mode. I deleted the file through my Anti-Virus,
> but when i restarted my pc the next day the same Trojan
> was there again. It doesnt actually excute itself, but
> the file downloads itself somehow. I've looked for
> information on it but i cant find away to get rid of it
> for good. Please help me. The name of it is Trojan horse
> Downloader.Agent.AL. It's always
> in "C:\Temp\BDL74125.exe". Thanks
> Lance Cook
>



 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
EGAUTH.DLL Trojan horse P2E.AR - Trojan horse Dialer.11.BD latebidz Anti-Virus 2 24th Oct 2004 08:26 PM
trojan horse ' downloader' gongie2 Windows XP Help 0 22nd Oct 2004 06:02 AM
Trojan horse downloader.Swizzor.N =?Utf-8?B?UmVlc2U=?= Windows XP Help 1 10th Apr 2004 04:11 PM
Trojan horse Downloader.Rvp.D in system info folder =?Utf-8?B?bmdvbGF5?= Windows XP Security 2 1st Feb 2004 10:36 PM
Trojan horse downloader =?Utf-8?B?R3JpZmY=?= Windows XP Help 4 19th Jan 2004 12:26 PM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 02:27 AM.