Win Xp Sp 2 update & restore problem

[Guest]

I had a Trojan Virus that was removed, since then, I cannot do a Win update -
Explorer freezes. I have tried to do a Restore to previous dates, but
computer stops at "shutting down" when I manually turn off and back on I get
message "restore was interrupted..."
If anyone has any ideas...please let me know.
Thanks in advance
Rich

 

[Bert Kinney]

Hi Rich,

There's a chance the Virus could be reinstalled using System Restore. At
this point if the virus has been removed I would suggest doing a repair
install.

How to Perform a Windows XP Repair Install by Michael Stevens MS-MVP:
http://michaelstevenstech.com/XPrepairinstall.htm

 

[Gerry Cornell]

Rich

What was the name of the Trojan?

You may still need to clean the system as one trojan can open the doors
for others!
When dealing with a persistent virus / trojan you need to delete system
restore points and not use them as they will contain the virus and put
it back into your system. Turn off System Restore until cleaning is
finished. Also run your anti-virus with updated definitions in safe
mode. Sometimes you need to run an anti-virus from a floppy and Trend
offer one that can be used.

Create a new folder named Sysclean (e.g., C:\Program files\Sysclean, or
just a desktop folder).
Download Sysclean.com (http://www.trendmicro.com/download/dcs.asp) and
place it in this folder.

Download the latest Controlled Pattern Release zip
(http://www.trendmicro.com/download/pattern.asp, e.g., lpt123.zip) and
extract its contents to the same folder. See the Readme text file for
additional instructions.

Delete Temporary Internet Files (IE Tools>Internet Options>General)
accepting the option to delete all offline content. Reboot and delete
contents of all TEMP folders and then your Recycle Bin.

Close all running programs including your anti-virus application, go
offline, and run Sysclean. For best results, do nothing with the machine
until the scan completes.

If the scan shows any infections in System Restore files and you're
running WinXP, create a new Restore Point
(Start>Programs>Accessories>System Tools>System Restore), then delete
all but the most recent Restore Point (Start>Programs>Accessories>System
Tools>Disk Cleanup>More options).

Work through the spyware removal programmes etc in turn in safe mode
until you get no results.

Afterwards, update your own anti-virus application and perform another
full system scan.

Finally run HijackThis and post the HijackThis log to the HijackThis
forum here:
http://aumha.net/

You will need to register with Aumha to be able to post.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Guest]

Thanks Gerry'
The virus was called Trojan.Vundo.
Based on this info, does your solution still apply?
FYI, I have run Norton AntiVirus' Trojan removal tool (completely
worthless), Windows malicious software removal tool and Webroot's Spy Sweeper
(the only one that worked)
Rich

 

[Gerry Cornell]

Rich

With regard to Norton did you notice this in the notes for using the
Removal Tool?

Important: You must have administrative rights to run this tool on
Windows NT 4.0, Windows 2000, or Windows XP.

However, this Trojan is problematic regarding removal. You need to clean
the machine as best you can and then submit a HijackThis log for review.
The forum I suggested has experience of this trojan.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~