From: Paul Schmehl <[EMAIL PROTECTED]>
Reply-To: Paul Schmehl <[EMAIL PROTECTED]>
To: axid3j1al axid3j1al <[EMAIL PROTECTED]>,[EMAIL PROTECTED]
Subject: RE: [Full-Disclosure] Removal?
Date: Tue, 03 Feb 2004 19:07:14 -0600
--On Wednesday, February 4, 2004 12:41 AM +0000 axid3j1al axid3j1al <[EMAIL PROTECTED]> wrote:It was worth a shot. You could download pslist from sysinternals and use that to list the process id, and then use their pskill to kill it.
usr_crtl.dll wont unregister and fag.exe is not in the process list.
<http://www.sysinternals.com/ntw2k/utilities.shtml>
(I would put these on a write-protected floppy.)
I checked before. No entires or deviations on these names.
Then you should be able to remove the files. I would also check the registry for entries. You can use Ctrl F to search for the file names "usr_crt.dll" and "faq.exe" in the registry and remove them. Then reboot, and you should be able to remove them.
Any idea how this got on your computer?
Norton is fully patched to current as is windows update.
Did you try housecall.antivirus.com?Current versions of adaware, spybot (search & Destroy) or norton found any trace of the trojan. Even when pointed directly at that directory. Anything else that recgnises this?
I did but it not find the files in question.
Finally removed it by using msconfig -> general -> diagnostic startup.
Then fag.exe was finally in the process list so I could kill it and then delete the directory
f~q.
Is there a current virus/trojan checker that properly reports what this is/does?
Also on a fully patched xp system killing all the svchost.exe's causes the NT_AUTHORITY message to come up and gives a minute to reboot. Which MS update was meant to fix this?
Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_________________________________________________________________
E-mail just got a whole lot better. New ninemsn Premium. Click here http://ninemsn.com.au/premium/landing.asp
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
