Hidden Trojan.. anyone help out?

[NightTrain]

Well, I've been gone most of the Summer, and I've got a trojan on this machine at home.

I'm running XP Pro, AVG anti-virus, Spybot S&D and Adaware.

AVG says I'm clean.

Adaware says I'm clean.

Spybot tells me I've got 5 entrees of DSO Exploit, and it can't remove them, even when I tell it to go ahead and run at next startup.

Then, after roughly 15 minutes of inactivity, I get a message from windows:

Virus
Trojan horse Downloader.winshow.AT detected at C:\System Volume Information\_restore{7BF9A251-DD3O-488D-BF66-BAE458F9ACEA}\RP187\A004958.dll

I'm reluctant to rip out that .dll file in that System Volume Information area... as I've had very bad experiences with doing such things in the past. I'm surprised that AVG isn't detecting it, unless the message itself is a bogus message.

XP Pro is fighting my attempts to access the System Volume Information, I've already turned off the 'hide system files' and the like under Tools, but it's still telling me to go away when I try to open it although it's visible now.

Any ideas?

 

[jimnyc]

It doesn't seem to be a big deal. Read these 2 threads to help you out.

http://forums.devshed.com/t158173/s.html
http://forums.windrivers.com/showthread.php?t=58851

Hope that helps!

 

[eric]

The DSO exploit is nothing to worry about. As far as the trojan is concerned try this; click on start, programs, acessories, system tools, system restore, and turn it off, allowing XP to delete all previous restore points (they already contain the trojan). Now reboot and turn system restore back on. Let me know if this helps.

Also never delete a dll or ocx unless you are absolutely sure there are no dependencies.

 

[eric]

XP Pro is fighting my attempts to access the System Volume Information, I've already turned off the 'hide system files' and the like under Tools, but it's still telling me to go away when I try to open it although it's visible now.

This is due to the security permissions of the folder. It is set by window to system, meaning only the OS has access to it, not even the administrator.

 

[NightTrain]

Thanks, guys.

Forgot to post that I tried what Eric suggested right before I walked out the door on my way back down here... running short on time as usual. Worked like a charm! Once XP dumped the SVI files, she's clean as a whistle!

My guess is that the SVI files are kept isolated from all other programs, which makes sense if you have a virus running rampant through the rest of your machine. That way, you have an uncorrupted set of files available to reload with. Am I on track?

Again, thanks for the help fellas!

 

[RFB]

use Linux

 

[eric]

use Linux

From a tech point of view, I agree, but for the average end user, this is not a good option.

 

[rtwngAvngr]

Get a mac!

 

[eric]

Get a mac!

You mean the one with : 2 all beaf patties, special sauce, lettuce, cheese, pickles, onions, on a sesame seed bun ?????

 

[5stringJeff]

Last hidden Trojan I knew about was in my bedroom...

 

[freeandfun1]

Last hidden Trojan I knew about was in my bedroom...

lol, I was just gonna say, "look in your wallet".

 

[RFB]

Another way to go is to go into the registery and try and delete the offending little item from there. If you need a hand let me know

 

[Said1]

Another way to go is to go into the registery and try and delete the offending little item from there. If you need a hand let me know

I have 2 registery errors I can't get rid of...any hints?

 

[drac]

I have 2 registery errors I can't get rid of...any hints?

what errors and who reports them? need more info

 

[Said1]

what errors and who reports them? need more info

Check disk utility reports it, and there error is with a file that goes something like this:
hkey_local_machine_software/clesses/clsid

 

[eric]

That is a registry key, not a file. Post the exact error and I will tell you what you should do. DON'T go playing around in the registry by yourself, you can cause programs to stop working as well as windows itself.

Once you post the exact error I can tell you step by step how to resolve it, SAFELY. Never just delete entries because someone tells you too. Unless that person is a programmer and understands COM object registration and threading models, they can do more harm than good.

 

[Said1]

That is a registry key, not a file. Post the exact error and I will tell you what you should do. DON'T go playing around in the registry by yourself, you can cause programs to stop working as well as windows itself.

Once you post the exact error I can tell you step by step how to resolve it, SAFELY. Never just delete entries because someone tells you too. Unless that person is a programmer and understands COM object registration and threading models, they can do more harm than good.

That is exactly why I left it ALONE. The others were approved by my brother-in-law who is an expert. This one was found after he left. I will get the exact info in a second, I'll pm it ok?

 

[eric]

K

 

[Said1]

Scan still running. Thought I might as well run a deep scan while I was at it.