Re: help with removing hostkill trojan

From: Tieu (Hey.D_at_Not-Spam.Me)
Date: 06/16/05 

Date: Thu, 16 Jun 2005 17:18:01 -0400

Hi,

Your Multi-AV works great on Win2K. It's not really compatible with Win98 or
XP. When I open it in Win98, a screen flashes and goes away. On with WinXP,
i see a screen as it is in Win2K but when select 1, 2 or 3 to download, it
brings up a shutdown windows. Anyway, this is out of question. Let me get
back to your questions.

MCafee detected: Reg/LowZones (files C:\Winnt\system32\Ransy.Reg, Rany.reg),
Downloader-QG (winnt\system32\update-sp1.htm, update-sp2.htm..), QHost
(c:\b.bat), SDBot, HackDefender (c:\system.exe)
Norton Detected: Randex (c:\dllpt.exe), hostkill9(b.bat), HackDefender
(c:\system.exe)
Trend and Sophos detechted something else.

I scanned in SafeMode first then Normal Mode.

Now, when I reboot my computer, Norton gives warning message for Randex Worm
(file ddlpt.exe. I have manually go to Process Listing to deleted this file)

I run Mcafee scan again, and as you expect, LowZones, Downloader-QG are on
the list.

I did reinstalled one Win2K computer though and it got infected with Randex
and hostkill next day. I guess the Trojans spread over the local network.
WinXp and Win98 are ok.

Thanks again.

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:u$pWsyScFHA.1404@TK2MSFTNGP09.phx.gbl...
> From: "Phil Weldon" <notdiscosed@example.com>
>
> | 'David H. Lipman' wrote, in part:
> |
> | "You really need to supply more information."
> |
> | Do you sometimes feel as if you were a dentist? Perhaps you should come
up
> | with a work *** to be filled out when a user comes up against an
> | intractable infection.
> |
> | Phil Weldon
>
> Yes Phil ;-)
>
> Sometimes getting the pertinent data can be like pulling teeth.
>
> I recently answered a question that was...
>
> "I have a list of computer names. Some of which exist and some don't. I
have
> a script that I run to collect inventory information. My problem is that
it
> does not handle the non existing servers very well. I would like to
include a
> test that confirms that the server exists before running the rest of the
> script AND if it does not exist skips it and moves on.
> TIA
> Mike"
>
> My answer:
> "nbtstat -a Host_Name | find /c /i "host not found"
>
> If the host doesn't exist, it will return the value= 1
> if it does exist it returns the value= 0"
>
> He then replied...
> "Thanks David. I should have been more clear. I need this to work within a
VB
> Script."
>
> So I wasted my time coming up with an answer and testing it.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>