R
rod
We have that infernal Zlob trojan,
nothing else seems to remove it,
maybe we need to reload Windows?
Thanks.
nothing else seems to remove it,
maybe we need to reload Windows?
Thanks.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
A
Alias
rod said:We have that infernal Zlob trojan,
nothing else seems to remove it,
maybe we need to reload Windows?
Thanks.
Reloading Windows with a clean install is the for sure way. Or you can
spend hours fighting with it and not knowing if there is anything else
that the apps you've used haven't detected.
Alias
N
nass
rod said:We have that infernal Zlob trojan,
nothing else seems to remove it,
maybe we need to reload Windows?
Thanks.
If the Restore Point not infected then you can.
Try and then run a scan and see if it all clear or still lurking and
infecting your restore points too.
P
PA Bear [MS MVP]
Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315
Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.
Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware
When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0, or other
appropriate forums for review by an expert in such matters, not here.**
If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
http://support.microsoft.com/kb/827315
Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.
Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware
When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use (in
conjuction with some other utilities). HijackThis will NOT fix anything on
its own, but it will help you to both identify and remove any
hijackware/spyware with assistance from an expert. **Post your log to
http://aumha.net/viewforum.php?f=30,
http://forums.spybot.info/forumdisplay.php?f=22,
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0, or other
appropriate forums for review by an expert in such matters, not here.**
If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
D
David H. Lipman
From: "nass" <[email protected]>
| If the Restore Point not infected then you can.
| Try and then run a scan and see if it all clear or still lurking and
| infecting your restore points too.
Actually many forms of malware corrupt or disable the System restore cache.
| If the Restore Point not infected then you can.
| Try and then run a scan and see if it all clear or still lurking and
| infecting your restore points too.
Actually many forms of malware corrupt or disable the System restore cache.
N
nass
David H. Lipman said:From: "nass" <[email protected]>
| If the Restore Point not infected then you can.
| Try and then run a scan and see if it all clear or still lurking and
| infecting your restore points too.
Actually many forms of malware corrupt or disable the System restore cache.
True, but some milke you out (??) first then start to be destructive and try
to hide and erase their footprint!
HTH,
nass
D
David H. Lipman
From: "nass" <[email protected]>
| True, but some milke you out (??) first then start to be destructive and try
| to hide and erase their footprint!
| HTH,
| nass
| ---
| http://www.nasstec.co.uk
I don't understand :-(
| True, but some milke you out (??) first then start to be destructive and try
| to hide and erase their footprint!
| HTH,
| nass
| ---
| http://www.nasstec.co.uk
I don't understand :-(
N
nass
David H. Lipman said:I don't understand :-(
Meaning some viruses will not start to be destructive from the start of its
being loaded and excuted on the User machine.
Ex..Password stealers, Pop-Up/marketing Trojans (fake alert)/StartUp page,
Trojan dropper..etc
These viruses patterns not destructive at first, but rather resident program
sending data (Commands/Data packets) from and to the user machine to the
intruder server !!!
D
David H. Lipman
From: "nass" <[email protected]>
| Meaning some viruses will not start to be destructive from the start of its
| being loaded and excuted on the User machine.
| Ex..Password stealers, Pop-Up/marketing Trojans (fake alert)/StartUp page,
| Trojan dropper..etc
| These viruses patterns not destructive at first, but rather resident program
| sending data (Commands/Data packets) from and to the user machine to the
| intruder server !!!
Yes, these types of malware do NOT want to give themselves away. They want to keep
performing their respective payload as long as possible.
However, how doe that tie-in with the system restore Cache ?
| Meaning some viruses will not start to be destructive from the start of its
| being loaded and excuted on the User machine.
| Ex..Password stealers, Pop-Up/marketing Trojans (fake alert)/StartUp page,
| Trojan dropper..etc
| These viruses patterns not destructive at first, but rather resident program
| sending data (Commands/Data packets) from and to the user machine to the
| intruder server !!!
Yes, these types of malware do NOT want to give themselves away. They want to keep
performing their respective payload as long as possible.
However, how doe that tie-in with the system restore Cache ?
N
nass
David H. Lipman said:From: "nass" <[email protected]>
| Meaning some viruses will not start to be destructive from the start of its
| being loaded and excuted on the User machine.
| Ex..Password stealers, Pop-Up/marketing Trojans (fake alert)/StartUp page,
| Trojan dropper..etc
| These viruses patterns not destructive at first, but rather resident program
| sending data (Commands/Data packets) from and to the user machine to the
| intruder server !!!
Yes, these types of malware do NOT want to give themselves away. They want to keep
performing their respective payload as long as possible.
However, how doe that tie-in with the system restore Cache ?
Back to the Old game Cat and Mouse Dave LOL
T
The Real Truth MVP
Use my Remove-it software, it will remove that malware from your system.
Choose yes for all options when prompted. Download it here
http://pcbutts1.com/downloads/tools/tools.htm
Choose yes for all options when prompted. Download it here
http://pcbutts1.com/downloads/tools/tools.htm
R
rod
Thank you to everybody who replied.
I appreciate your help very much.
Rod.
I appreciate your help very much.
Rod.
R
rod
Just a FYI
I tried numerous times for system restore, employing differing dates,
the process went thorough to reboot, then a pop up screen
arrived saying it could not restore and that nothing had changed.
I guess the trojan is responsible.
I tried numerous times for system restore, employing differing dates,
the process went thorough to reboot, then a pop up screen
arrived saying it could not restore and that nothing had changed.
I guess the trojan is responsible.
A
Alias
rod said:Just a FYI
I tried numerous times for system restore, employing differing dates,
the process went thorough to reboot, then a pop up screen
arrived saying it could not restore and that nothing had changed.
I guess the trojan is responsible.
By now you could have reinstalled XP. That's what I would do.
Alias
P
PA Bear [MS MVP]
Ignore this MVP imposter!
For some background on this well-known thief, see David Lippman's posts in
this thread:
http://groups.google.com/group/micr..._frm/thread/5172ca5571f3e54f/656904085932c872
Specifically
http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e
and
http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f
For some background on this well-known thief, see David Lippman's posts in
this thread:
http://groups.google.com/group/micr..._frm/thread/5172ca5571f3e54f/656904085932c872
Specifically
http://groups.google.com/group/microsoft.public.security.homeusers/msg/213247814fb4d61e
and
http://groups.google.com/group/microsoft.public.security.homeusers/msg/e19fce884897662f
D
David H. Lipman
From: "rod" <[email protected]>
| Just a FYI
| I tried numerous times for system restore, employing differing dates,
| the process went thorough to reboot, then a pop up screen
| arrived saying it could not restore and that nothing had changed.
| I guess the trojan is responsible.
No. It is not the Trojan's fault.
If you *must* do a system restore, I suggest performing it in Safe Mode.
Doing it in Safe Mode has a greater chance that it will succeed.
| Just a FYI
| I tried numerous times for system restore, employing differing dates,
| the process went thorough to reboot, then a pop up screen
| arrived saying it could not restore and that nothing had changed.
| I guess the trojan is responsible.
No. It is not the Trojan's fault.
If you *must* do a system restore, I suggest performing it in Safe Mode.
Doing it in Safe Mode has a greater chance that it will succeed.
R
rod
Yes, you are of course, correct,
alas! I am human...and hope springs eternal (wry grin)
"Alias"
alas! I am human...and hope springs eternal (wry grin)
"Alias"
R
rod
Thank you David,
I hadn't considered that,
I give it a go.
Its either that or reload windows,
I deleted something along the way (maybe Vista drive.exe)
and I have lost my quick launch bar icons.
I hadn't considered that,
I give it a go.
Its either that or reload windows,
I deleted something along the way (maybe Vista drive.exe)
and I have lost my quick launch bar icons.
R
rod
Restore failed in safe mode on 4 dates.
It would run through to reboot, as soon a I typed
in the administrators password, the fail pop up screen arrived.
I found the quick launch bar.
It would run through to reboot, as soon a I typed
in the administrators password, the fail pop up screen arrived.
I found the quick launch bar.
D
David H. Lipman
From: "rod" <[email protected]>
| Restore failed in safe mode on 4 dates.
| It would run through to reboot, as soon a I typed
| in the administrators password, the fail pop up screen arrived.
Like I wrote, malware can corrupt the System Restore cache.
Either the following or a wipe and OS reinstall...
Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
Then post the contents of the HJT log in your post in one of the below expert forums...
{ Please - Do NOT post the HJT Log here ! }
Forums where you can get expert advice for HiJack This! (HJT) Logs.
NOTE: Registration is REQUIRED in any of the below before posting a log
Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0
Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.malwarebytes.org/forums/index.php?showforum=7
Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13
| Restore failed in safe mode on 4 dates.
| It would run through to reboot, as soon a I typed
| in the administrators password, the fail pop up screen arrived.
Like I wrote, malware can corrupt the System Restore cache.
Either the following or a wipe and OS reinstall...
Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
Then post the contents of the HJT log in your post in one of the below expert forums...
{ Please - Do NOT post the HJT Log here ! }
Forums where you can get expert advice for HiJack This! (HJT) Logs.
NOTE: Registration is REQUIRED in any of the below before posting a log
Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0
Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html
http://www.malwarebytes.org/forums/index.php?showforum=7
Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://aumha.net/viewforum.php?f=30
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13
Ask a Question
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.