[Resolved] virus-backdoor trojan

I have 3 backdoor trojan virus on my ME System in quarantine and I would like to know how to get rid of these nasty things. I think I need the files. the 3 are: OLDER,exe Location:, windows #2 Explorer.exe Location:, C;windows\explorer\ and, #3 explorer[1].exe location: c:windows\tempory. Please make the explanation simple as I am a novice and an old one at that. Thanks in advance. ( I have Norton Anti Virus and Zone Alarm installed now. )

 

run the Norton antivirus & let it locate & hopefully quarintine the trojans


how did you find out you had them?

 

The only required file is c:\windows\explorer.exe.

I don't understand how you can be running windows if that is in quarantine though.

I would delete the others and extract a new copy of explorer.exe to overwrite any infected version in c:\windows

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q265371

You may also want to consider doing a "System Restore" since no files in your restore archive are infected.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q267951

 

Hello Savvylady and Rollin'Rog:


Thanks for your replys: Savvylady: I got the three back door virus by running Norotn Anti-Virus Progrom. ( Please see my original post) ( Named them them, that is) Rolling'Rog: I don't understand how I can be operating Windows Exployer with them guys in quarantine either. Should I delete them ? What happens then? Will My system work? I understand I'm limited in words to express my frustration and am confident that you two will see me through this mess. Thanks to both of you. Jim

 

there is several varietys of the backdoor trojan.... do you see which it is?

Anyway see this very informative page

http://www.geocities.com/SiliconValley/Heights/3652/trojan.html

 

Your file location:

#2 Explorer.exe Location:, C;windows\explorer\

seems to indicate there is a FOLDER explorer in the Windows directory with an infected explorer.exe within it.

If this is the case AND there is an uninfected copy of explorer.exe in c:\windows

then it is ok to delete the infected one. But you should verify that you have a copy of Explorer.exe (approx 168kb) in C:\windows that is not quarantined or infected.

You can do a Search (Find) for all copies of explorer.exe and verify which is which.

 

to: Savvylady and Rollin'Rog:

I have your posts and am grateful for your interest in my problem and, your continued interest. Let me see if I can digest your ansers and understand what to do.

 

To Savvylady and Rollin'Rog:

I very much appreciate your continued interest in my problem and your answers to my inquires. Some of your answers are over my head and I would like overnight to try Rollin'Rog's suggestion on i.d.'g the files in search. By the way, Rog. I have done a system restore and that worked great but I want the darn things off my machine. By the way, I will not make the mistake again of downloading a program without scanning it.
I think this is a terriff forum and you guys are great!
With thanks again, Jim.

 

If you have done a system restore then the remaining infected files can be deleted without worry. They would not be files Windows is using or needs. Like you, I was only puzzled by that one copy of explorer.exe -- but it can't be the one which is in use.

 

Rollin Rog:
With ref. to my virus problem, I used a little bit of "uncommon sense" and figured if they were in quarantine they sure weren't doing me any good there. I went to The Norton Anti-virus program and deleted all of them. I'll let you know if the roof caves in. Thanks again. Jim

 

You're welcome. You should be fine, there is an apparent description of this trojan here:

http://forums.techguy.org/showthread.php?s=&threadid=63576


We've been seeing some variations on the name.