who can identify this trojan?

[413345]

have become infected with a truly elaborate trojan which has performed the following on my system, starting with a windows error message: "Registry restored. One of the files containing the systems register data, had to be restored"...

1. Norton Internet Security is nothing but a blank screen upon opening it (leaving it useless)
2. I am unable to access internet through IE5: the system attempts to download files instead, failing.
3. The Run-command button has been removed from the start menu, although the settings imply it should be there (right-clicking).
4. Unable to access programs through start menu. The button is there but nothing happens when clicked...

Hope somebody can recognize and identify this sucker! Thanks!

 

[stduc]

Can you post your tasklist here so I can have a look?

Open a command window, type tasklist > t.txt

 

[stduc]

Just noticed - you have no start menu/run button. Can you start command using ctr;/alt/del - start task manager and use new task to run cmd? (assuming you are running XP)

 

[413345]

Hi thanks for your reply.

Can run commands by your suggestion or by pressing windows key+r

but I don't have xp pro, so no tasklist.

I did however find out that I have a explorer.exe running in the windows\system32 directory, which it shouldnt. It has not altered any shell entries in the registry as far as I can tell, nor in the system.ini, so I am still at loss as to which virus I have actually contracted...

 

[413345]

also found wintime.exe which is the dowloader.harnig virus, but I don't think that would have caused all the troubles I have outlined above, would it?

 

[carrr]

Sounds like you might have Bube. Look here:

http://www.sophos.com/virusinfo/analyses/w32bubea.html

Not a perfect match, I admit, but it's the hot one at the moment.
Also, see thread760-1032203

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[stduc]

I've no idea then - sorry. How about removing the hard drive & getting another machine to scan it? Or building a self booting virus scanning floppy disk on another machine?

 

[carrr]

Bube removal instructions can be found here:

http://www.bleepingcomputer.com/for...n32Beavis_aka_isrvs-tx11662-0.html#entry72865

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[LloydSev]

http://www.tek-tips.com/viewthread.cfm?qid=1032203&page=1

Computer/Network Technician
CCNA

 

[413345]

Hmm, no it doesn't appear to be the Bube at all, I have no change in the win.ini file nor any of the listed registries...

The worm is certainly attempting to download something when I try to access the web, but I get a message that the download of files failed...

So I am 100% I got the downloader.harnig, but I've yet to account for the presence of the explorer.exe in the systems folder. So far I have found no match in terms of symptoms and registry changes...

 

[carrr]

Explorer/exe in the System32 folder?

http://www.neuber.com/taskmanager/process/explorer.exe.html

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[pechenegs]

Can you download and post a hijack this log?

Save hijack this to it's own folder such as c:\ hijack this so that it runs properly and can make back ups., and click scan then save the log and post it here so we can take a look at it for you.

hijack this

http://www.majorgeeks.com/downloads31.html

 

[413345]

Thanks for the correction concerning the explorer.exe in the systems folder, turns out it is the correct location after all.

As for the hijack log, I have gone over this time and time again, and there is nothing suspicious about it at all, everything ok there. The win.ini, sys.ini and misconfig files are also ok.

 

[413345]

Oh, and now I can't start up windows at all, not even in safe mode. I am seriously infected here, with no backup of important documents....

How can I make a backup of documents from DOS only?

 

[413345]

I run a windows XP, and it seems impossible to enter MS DOS without entering windows first. I desperately need to back up some files on the disk (copy them to a removable device), but as I am completely unable to start windows (it hangs up no matter what kind of mode I attempt to start it in), I need to know if it is possible to do this from this messed up state my computer is in....

So please help...

 

[stduc]

I wonder if you have a hardware problem here? Whatever the issue is I suggest you remove the drive to another machine and back it up pronto!

 

[LloydSev]

If you have Norton Internet Security, you should have rescue discs??

Computer/Network Technician
CCNA

 

[413345]

No, my NIS is supplied by my ADSL supplier, downloaded only.
Removing the drive could be a problem: it is a laptop...

 

[413345]

SO: is there any way of copying files to removable drive without starting up windows XP?

 

[LloydSev]

I was talking more along the lines of the floppies you make when setting up NIS.

Computer/Network Technician
CCNA