G
Guest
Hi, Need Help, some sort of Trojan (I suspect) is running explorer.exe full on 97%-100%, not allowing computer to function. I have Norton AV & Internet Security w/ latest definitions, BoClean w/latest files. AV shows no virus. Went to norton site, downloaded & ran fix tools, (Anig, Autoupdr, blast, goner, welch, novarg, & Qhost) all show no infection. BoClean found an attack on 2-11, which was when it started, multiple trojans. boClean claimed to have isolated & deleted trojans as follows from BoClean Log.
-----------------------------
02/11/2004 17:27:01:
Analyzing file C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EX
Trojan horse was found in above fil
ENVOLO TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
-----------------------------
02/11/2004 17:27:25: ENVOLO TROJAN VARIANT STOPPED!
Trojan horse was found in memory
C:\PROGRAM FILES\AUTOUPDATE\AUTOUPDATE.EXE contained the trojan.
Active trojan horse WAS shut down. System safe
-----------------------------
02/11/2004 17:27:59: C:\WINDOWS\X6DE3.DL
Trojan horse was found in above fil
JIMMYHELP TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
-----------------------------
02/11/2004 17:28:29: LOPIST TROJAN VARIANT STOPPED!
Trojan horse was found in memory
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE contained the trojan.
Active trojan horse WAS shut down. System safe
-----------------------------
02/11/2004 17:28:59:
Analyzing file C:\PROGRA~1\MEDIA\MEDIA\UPDATE~1.EX
Trojan horse was found in above fil
STATBLAST TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
-----------------------------
02/11/2004 17:29:01:
Analyzing file C:\PROGRA~1\MEDIA\MEDIA\UPDATE~1.EX
Trojan horse was found in above fil
STATBLAST TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
-----------------------------
02/11/2004 17:29:02:
Analyzing file C:\PROGRA~1\MEDIA\MEDIA\UPDATE~1.EX
Trojan horse was found in above fil
STATBLAST TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
-----------------------------
02/14/2004 12:01:33: C:\WINDOWS\BI.DL
Trojan horse was found in above fil
BI TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
Now, nothing else seems to be appearing, BUT.... the computer just does NOT want to run programs. Outlook came down with a GUI error in MSDART, that the detect & repair function fixed. Clicking on files on the desktop does not want to open, Going to Control Panel shows hourglass, then dissappears, never opens. IE 6 will open, but VERY slowly, any changes seems to take forever. Programs go blank, or show solid white, or superimposed desktop pictures, and eventually come on. I dread having to F Disk everything, including MBR, but it seems inevitable. Need to salvage the address, contacts and messages saved from Outlook. Need to salvage some programs & files bought online & their registration keys. CD Burner seems to work but slowly, so possible to burn copies, provided all links & registry can be found. Strange, all functions but burner work on safe mode. See below
If F Disk is inevitable, with F Disk of Master Boot Record as well, can XP Pro still format the disc on re-install or will another program be needed to start re-install. WOULD LOVE SOME HELP, if this is fixable!!!! Please respond.
-----------------------------
02/11/2004 17:27:01:
Analyzing file C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EX
Trojan horse was found in above fil
ENVOLO TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
-----------------------------
02/11/2004 17:27:25: ENVOLO TROJAN VARIANT STOPPED!
Trojan horse was found in memory
C:\PROGRAM FILES\AUTOUPDATE\AUTOUPDATE.EXE contained the trojan.
Active trojan horse WAS shut down. System safe
-----------------------------
02/11/2004 17:27:59: C:\WINDOWS\X6DE3.DL
Trojan horse was found in above fil
JIMMYHELP TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
-----------------------------
02/11/2004 17:28:29: LOPIST TROJAN VARIANT STOPPED!
Trojan horse was found in memory
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE contained the trojan.
Active trojan horse WAS shut down. System safe
-----------------------------
02/11/2004 17:28:59:
Analyzing file C:\PROGRA~1\MEDIA\MEDIA\UPDATE~1.EX
Trojan horse was found in above fil
STATBLAST TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
-----------------------------
02/11/2004 17:29:01:
Analyzing file C:\PROGRA~1\MEDIA\MEDIA\UPDATE~1.EX
Trojan horse was found in above fil
STATBLAST TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
-----------------------------
02/11/2004 17:29:02:
Analyzing file C:\PROGRA~1\MEDIA\MEDIA\UPDATE~1.EX
Trojan horse was found in above fil
STATBLAST TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
-----------------------------
02/14/2004 12:01:33: C:\WINDOWS\BI.DL
Trojan horse was found in above fil
BI TROJAN STOPPED by BOCLEAN!
Above file copied to C:\evidence.boc for examination
Active trojan horse was shut down. System now safe
Trojan horse was removed, registry cleaned
Now, nothing else seems to be appearing, BUT.... the computer just does NOT want to run programs. Outlook came down with a GUI error in MSDART, that the detect & repair function fixed. Clicking on files on the desktop does not want to open, Going to Control Panel shows hourglass, then dissappears, never opens. IE 6 will open, but VERY slowly, any changes seems to take forever. Programs go blank, or show solid white, or superimposed desktop pictures, and eventually come on. I dread having to F Disk everything, including MBR, but it seems inevitable. Need to salvage the address, contacts and messages saved from Outlook. Need to salvage some programs & files bought online & their registration keys. CD Burner seems to work but slowly, so possible to burn copies, provided all links & registry can be found. Strange, all functions but burner work on safe mode. See below
If F Disk is inevitable, with F Disk of Master Boot Record as well, can XP Pro still format the disc on re-install or will another program be needed to start re-install. WOULD LOVE SOME HELP, if this is fixable!!!! Please respond.