Help with Trojan.dropper - HackTool

[zarkon4]

We have an NT Terminal Server 6.0 infected with
trojan.dropper. To clean this requires safe mode and
this OS has no safe mode, that I can find anyway. Any suggestions on how to clean it, other than reloading?
Symantec won't clean it or quarantine it. some of files
include tskman.exe, full.exe, check.exe, pskill.exe, smss.exe, services.exe, and crss.exe.

 

[pechenegs]

hi, welcome to TSG.

Download hijack this from the link below.Please do this. Click here:

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

to download HijackThis. Click scan and save a logfile, then post it here so
we can take a look at it for you. Don't click fix on anything in hijack this
as most of the files are legitimate.

 

[erikhertzel]

You can also try this:

Download this:

http://www.ewido.net/en/

Check for updates and then run a complete system scan. Also do the following:

http://housecall.trendmicro.com/

Then, post back if you need further help.

Hope this helps,

Erik

 

[tfg13]

At the terminal, are you able to reboot the server? Once the "Windows" splash screen comes up, and you press F8, what does it do/say?

 

[zarkon4]

Sorry, I posted the OS wrong.
There is no splash screen (it's NT 4.0 Terminal Server) so
there is no safe mode, we have antivirus-antispyware software but these are requiring a safe mode boot to clean it. Were just going to re-format and re-load. I cannot and will not connect the server back to our network until it is clean. Thanks anyway all.