[Resolved] virus-backdoor trojan

[lord_8383]

I have 3 backdoor trojan virus on my ME System in quarantine and I would like to know how to get rid of these nasty things. I think I need the files. the 3 are: OLDER,exe Location:, windows #2 Explorer.exe Location:, C;windows\explorer\ and, #3 explorer[1].exe location: c:windows\tempory. Please make the explanation simple as I am a novice and an old one at that. Thanks in advance. ( I have Norton Anti Virus and Zone Alarm installed now. )

 

[SavvyLady]

run the Norton antivirus & let it locate & hopefully quarintine the trojans


how did you find out you had them?

 

[Rollin' Rog]

The only required file is c:\windows\explorer.exe.

I don't understand how you can be running windows if that is in quarantine though.

I would delete the others and extract a new copy of explorer.exe to overwrite any infected version in c:\windows

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q265371

You may also want to consider doing a "System Restore" since no files in your restore archive are infected.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q267951

 

[lord_8383]

Hello Savvylady and Rollin'Rog:


Thanks for your replys: Savvylady: I got the three back door virus by running Norotn Anti-Virus Progrom. ( Please see my original post) ( Named them them, that is) Rolling'Rog: I don't understand how I can be operating Windows Exployer with them guys in quarantine either. Should I delete them ? What happens then? Will My system work? I understand I'm limited in words to express my frustration and am confident that you two will see me through this mess. Thanks to both of you. Jim

 

[SavvyLady]

there is several varietys of the backdoor trojan.... do you see which it is?

Anyway see this very informative page

http://www.geocities.com/SiliconValley/Heights/3652/trojan.html

 

[Rollin' Rog]

Your file location:

#2 Explorer.exe Location:, C;windows\explorer\

seems to indicate there is a FOLDER explorer in the Windows directory with an infected explorer.exe within it.

If this is the case AND there is an uninfected copy of explorer.exe in c:\windows

then it is ok to delete the infected one. But you should verify that you have a copy of Explorer.exe (approx 168kb) in C:\windows that is not quarantined or infected.

You can do a Search (Find) for all copies of explorer.exe and verify which is which.

 

[lord_8383]

to: Savvylady and Rollin'Rog:

I have your posts and am grateful for your interest in my problem and, your continued interest. Let me see if I can digest your ansers and understand what to do.

 

[lord_8383]

To Savvylady and Rollin'Rog:

I very much appreciate your continued interest in my problem and your answers to my inquires. Some of your answers are over my head and I would like overnight to try Rollin'Rog's suggestion on i.d.'g the files in search. By the way, Rog. I have done a system restore and that worked great but I want the darn things off my machine. By the way, I will not make the mistake again of downloading a program without scanning it.
I think this is a terriff forum and you guys are great!
With thanks again, Jim.

 

[Rollin' Rog]

If you have done a system restore then the remaining infected files can be deleted without worry. They would not be files Windows is using or needs. Like you, I was only puzzled by that one copy of explorer.exe -- but it can't be the one which is in use.

 

[lord_8383]

Rollin Rog:
With ref. to my virus problem, I used a little bit of "uncommon sense" and figured if they were in quarantine they sure weren't doing me any good there. I went to The Norton Anti-virus program and deleted all of them. I'll let you know if the roof caves in. Thanks again. Jim

 

[Rollin' Rog]

You're welcome. You should be fine, there is an apparent description of this trojan here:

http://forums.techguy.org/showthread.php?s=&threadid=63576


We've been seeing some variations on the name.