Re: Backdoor.ProratD and registry HELP!
From: Mike Burgess (winhelp2002_at_spamthis.com)
Date: 04/07/04
- Next message: vs: "Virus or spyware or what ?"
- Previous message: David H. Lipman: "Re: MSO3-26"
- In reply to: Randy: "Backdoor.ProratD and registry HELP!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 6 Apr 2004 21:15:32 -0400
Randy,
Download: Process Viewer [freeware] WinNT/2K/XP/ME/95/98
http://www.xmlsp.com/pview/prcview.htm
Download: KillBox
http://broadbandmedic.com/download/
Log on as Administrator in Safe Mode and use the above to "kill" (delete)
the files.
In extreme cases reboot and press F8 to bring up the Troubleshooting Boot
Menu.
Select: Safe Mode w\Command Prompt and press Enter. Log on as Administrator.
Once you do the above restart normally and remove the Registry entries (if
exists)
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 04-02-04]
Please post replies to this Newsgroup, email address is invalid
-- "Randy" <anonymous@discussions.microsoft.com> wrote in message news:192fa01c41c3a$33eac000$a301280a@phx.gbl... > I have this virus (backdoor.proratD) which shuts down > Norton antivirus and > firewall. I have 6 corrupted files: windows\winlogon.exe, > windows\system\service.exe, windows\systme32\fservice.exe > wincom.exe wininv.dll and winkey.dll. I cannot delete > the .dll files, even in safe mode as I am denied access. > I am told that the virus exists in the winkey.dll file. > I can delete the fservice and sservice, but they are > regenerated inmmediately(not so under safe mode, but once > reboot normal and they are there again). Registry changes > noted by norton and sophos I have found and deleted, but > they too are immediately replaced upon exiting registry, > again even under safe mode. Have noted no infestation (or > odd changes) of win.ini or system.ini files. In the > registry I notice that the HK > Root\htafile\shell\open\command is modified with a > mshta.exe file as is the > HKLM\software\classes\htafile\shell\open\command key and I > have read that these are 2 common places for virus > startup. > > My questions are (and excuse the small list): > > How do I delete the .dll files? > What is the mshta.exe file that exists in the WIN system > 32 file and would deleting its reference from the registry > hurt? > How can this virus monitor reg changes and fix > immediately, even in safe mode and can I overcome. > > I have windows XP pro with all updates. I appreciate > anyones assistance on this as Norton to date has not been > any help. >
- Next message: vs: "Virus or spyware or what ?"
- Previous message: David H. Lipman: "Re: MSO3-26"
- In reply to: Randy: "Backdoor.ProratD and registry HELP!"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
