XP infected w/Tro. Mitglieder, can't access Sys Restore.

[swannie2]

Error mess: "Can't find ___, you can browse to find it..."
I need to disable Sys Restore, but I can't get in.Am able to access Control Panel, but only a few files, can't get sys properties, yet I can change my desktop. When I was able to do a scan with Norton online (Can't access my own) it said I've got an "open port" that is bad, but I've got to get rid of the Mitglieder first, right? This is my first virus & I'm freaked. I feel so violated.

 

[carrr]

Restart and come in under Safe Mode.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[swannie2]

Thanks for the imput-I tried that first, but this thing has copied itself to my %System%\Window.exe & added the value "window.exe"="system \window.exe" to the registry key:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ,so that it runs when I start Windows, then adds the values:
"pid"="<Process ID>"
"uid"= "<Random & digit number>"
"port"= "<Listening Proxy Port>"
HKEY_CURRENT_USER/SOFTWARE/TIMEOUT
Thusly, I'm not able to access any anything except my docs, even in safe mode.Maybe I could go safe mode, command prompt, locate my System Restore files & disable it that way, then I can run my antivirus to fix the problem. I just don't know where to look. Thanks for the help.

 

[TexasSasquatch]

You dont mention which OS you are using, but I think you may be able to take care of this pretty easy.

http://securityresponse.symantec.com/avcenter/venc/data/trojan.mitglieder.i.html

Pay particular attention to the information in Removal Instructions 2, B and C.

Good luck and let us know how it turns out or if you need anything else.

Texas Sasquatch...

Gooney goo goo!

 

[swannie2]

Thanks for your help! Got rid of the bug by following instructions on link you provided. You guys are my heroes.

 

[TexasSasquatch]

Glad to hear it!



Texas Sasquatch...

Gooney goo goo!