Virus hit me hard, please help

[daniel kaplan]

got hit by some trojan off of a website. i saw as it actually knocked out
norton! then it installed mysearch and who knows what else?

now, my add/remove programs doesn't work...it's just an empty window with
the teext "change or remove programsadd new programs..." up top

please help...this sucks!

 

[Carsyn Gu [MSFT]]

Hi Daniel,

Thanks for your posting.

Would you please give me more information about the trojan application
affected to your system? Which website did you go and the application name?
Which program you wish to remove?

Please offer me more information for my further research.

Thanks for your understanding and cooperation.

Sincerely,
Carsyn Gu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
| Reply-To: "daniel kaplan" <[email protected]>
| From: "daniel kaplan" <[email protected]>
| Newsgroups: microsoft.public.win2000.general
| Subject: Virus hit me hard, please help
| Date: Sat, 8 Jan 2005 23:01:21 -0500
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
| Organization: Acecape, Inc.
| Message-ID: <[email protected]>
| Cache-Post-Path: [email protected]
| X-Cache: nntpcache 3.0.1 (see http://www.nntpcache.org/)
| Lines: 10
| X-Complaints-To: (e-mail address removed)
| Path:
cpmsftngxa10.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.s
ul.t-online.de!t-online.de!border2.nntp.dca.giganews.com!border1.nntp.dca.gi
ganews.com!nntp.giganews.com!atl-c02.usenetserver.com!c03.atl99.usenetserver
.com!news.usenetserver.com!newshosting.com!nx01.iad01.newshosting.com!post01
.iad01.newshosting.com!not-for-mail
| Xref: cpmsftngxa10.phx.gbl microsoft.public.win2000.general:169091
| X-Tomcat-NG: microsoft.public.win2000.general
|
| got hit by some trojan off of a website. i saw as it actually knocked out
| norton! then it installed mysearch and who knows what else?
|
| now, my add/remove programs doesn't work...it's just an empty window with
| the teext "change or remove programsadd new programs..." up top
|
| please help...this sucks!
|
|
|
|

 

[daniel kaplan]

well it's hard to say, since i lost norton in the process, and then
downloaded pc-cillin and let it do it all...let's see the logs at pc-cillin
show:

troj_scndthot.av and i also ran ad-aware se before hand....

also i noticed i got hit with a virus i have seen before...affect microsoft
media player....turns it into somethign bad, or just redirects, dunno....

 

[George Hester]

Actually it replaces the executable in C:\Program Files\Windows Media Player
and puts a call to it in your HKLM Run keys. I think it is around 24KB.