Evil Trojan! Need Help!

[Bohica]

Hi folks,

Wondering if anyone can give me a hand dealing with a Trojan my missus had managed to install. Below is the text of an email I sent to a friend about this - unfortunately he's as stumped as I am. Essentially, it blocks executables (so no AV software will run), re-writes itself to the registry when removed and I can't terminate the process. Ah, the wonderful world of XP.

If anyone can help me out I'll owe them one hell of a favour.

-------------



Hi mate,

Really hope you don't mind me tapping you brain again, but I tried the software you recommended and still no joy - can't execute the .exe.

The trojan now appears to be backdoor.beast.2.05. I've had to use a few online scans, which just feed back that it's a generic backdoor.best.family. But my wonderful Trojan matches this Sophos discription:

www.sophos.com/virusinfo/analyses/trojbeastdom.html

The problem I have is that when booted in safe mode as administrator (with system restore off) - I can't terminate the running programs. Any attempt to delete them fails. I've tried running program zapper, but it's an .exe, so doesn't load. In task manager there are up to four svchost processes running, however, when I terminate the one I believe to be the Trojan it forces a system shutdown, while any attempt to shut the others fails as they restart in seconds.

Removing the registry entries doesn't work either. They are replaced within seconds thanks to the running process.

What really irks me is that I finally upgraded to XP last month. If this were 98 at least I could boot to DOS and have a say in what loads!

Unless I can find a solution it's going to be a case of trying to back up about 25gb of information and doing a full system restore.

Any advice would be really appreciated.

 

[skysnapper]

try a a couple of web virus scans. Can't think of any off the top off my head but a quick google should find them

 

[Bohica]

Thanks SkySnapper - but I've tried the web-based scans already. They tell me (approximately) what the issue is, but can't actually deal with it.

 

[EoS]

ok ive got 2 ideas:
1:
first, get a boot diks/cd with dos or linux, all u ned is a simple command prompt
then u need to know the exact filename ofthe trojan exe ( i hope thers only one ) and then u simply delete that exe in dos/linux...now i cant say if the trojan has backups of itself that will install after that, or what happens to ur system if u simply del the file and windows cant find it the next time it boots...

2:
the other one would be that we could meet online, and if ur lucky the trojan doesnt have password enabled so i can get in and use the remove server feature of the client, normaly they have one

Oh, OR u could get the client from somewhere, hook ur pc to some kind of network ( if possible) and then use another pc on the network to remove the trojan using the rem.server feature...

thats all i can think of for now...

 

[Bohica]

ok ive got 2 ideas:
1:
first, get a boot diks/cd with dos or linux, all u ned is a simple command prompt
then u need to know the exact filename ofthe trojan exe ( i hope thers only one ) and then u simply delete that exe in dos/linux...now i cant say if the trojan has backups of itself that will install after that, or what happens to ur system if u simply del the file and windows cant find it the next time it boots...

Hi mate,

Tried last night - I've literally only just upgraded to XP so I'm a bit of a novice there (bring back DOS!). I created a DOS boot disk with an NTFS reader, but couldn't access the drive partitions, only the recovery folder. Bloody thing.

I know where the .com files and the server .dll are - so if I could reach them through DOS I could possibly fix things that way.

I don't think the client solution would work. Backdoor.beast has a huge number of configuration options and usually sends info back via ICQ/MSN Messenger to a passworded account - so without those details there's no way to access the Trojan. Nice idea though.

Mark.

 

[rcx21000]

Stick your drive into another computer (make SURE you don't accedentaly set it up to boot on that drive... ) Then, since nothing on the drive executes, you can easily delete all the icky files and put the HD back in your computer... If you don't want to do tha, get some AV software that has an option too boot off CD & scan, so you don't have to go into Windows.... (unless its flashed a BIOS that loads it automaticly, which I think isn't possible, but I dunno )

 

[bringoutthegimp]

Wondering if anyone can give me a hand dealing with a Trojan my missus had managed to install.

women & technology = bad combination

 

[Bohica]

Wondering if anyone can give me a hand dealing with a Trojan my missus had managed to install.

women & technology = bad combination

Mate - somehow I knew you were going to say that :lol:

 

[starwarsnerd]

If you don't have anything of great importance on the thing, and you don't have any other options, then I think the most obvious choice would be just just to boot from your XP instalation disk from the Boot Menu and format the drive (or is there something restricting that too?).

 

[bringoutthegimp]

Mate - somehow I knew you were going to say that :lol:

its so true though....women suck at computers. i was speaking to some chick a while back and she was like "i got this broadband thingy installed on my comp" and i went "wish i had broadband.....is it fast yeah?" and she goes "i dont know...all i use is msn". WHAT THE FUCK is the point in getting broadband when youre retarded at using a computer?