Is this a Valid Way to Get Rid of a Trojan?

Gyroscope · 10-29-2009, 02:27 PM

Funny (not!) thing happened to me today. I clicked on a Google link and it took me to an entirely irrelevant page. I smelled a rat immediately, and a full system scan with F-Secure revealed the Trojan-PWS.Win32.Kates.c in a [can't remember the name].obx file in C:/Windows. I attempted to delete it (through F-Secure) and yes, I'm sure you know the rest. It replicated itself. It did that also when I tried to rename it. Another symptom was that attempting to open the registry (either by double-clicking regedit or by entering 'regedit' in Run) resulted in the taskbar disappearing for a second or two - without registry editor ever running.

I read numerous threads with similar problems and they all suggest the combofix method. I tried something else. I opened the infected file with wordpad, deleted all the contents and saved it with the same name. It didn't replicate itself, it shows 0 KB size (of course), and F-Secure doesn't recognize it as a virus (of course). Regedit works. Full system scan with F-Secure doesn't find anything anywhere. After a couple of reboots, nothing has changed. File still 0 KB, regedit works, no viruses reported.

Is it safe to assume the problem is taken care of? I find it hard to believe - where is the initiator of the replication action?

Is there a specific registry entry (or anything else) I should check to see if there is still an infection lurking?

Thanks!

**Glaswegian** · 10-29-2009, 03:00 PM

Hi

Quote:

Is it safe to assume the problem is taken care of? I find it hard to believe - where is the initiator of the replication action?

Therein often lies the problem. Although you may have disabled this one bad file, there may be others hidden away (an AV will not detect everything) - including the infector or the main loading point.

We cannot give you any advice until you start here and follow the instructions.

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

Do not post your logs back in this thread - follow the guidance in the above link!

If you have problems with any of the steps, simply move on to the next one and make a note of the problem in your reply.

Please note that the Security Forum is always busy, so I would ask for your patience while waiting for a reply - it may take a few days.

10-29-2009, 02:27 PM	#1 (permalink)
Gyroscope Registered User Join Date: Jul 2008 Posts: 19 OS: Windows XP SP2	Is this a Valid Way to Get Rid of a Trojan? Funny (not!) thing happened to me today. I clicked on a Google link and it took me to an entirely irrelevant page. I smelled a rat immediately, and a full system scan with F-Secure revealed the Trojan-PWS.Win32.Kates.c in a [can't remember the name].obx file in C:/Windows. I attempted to delete it (through F-Secure) and yes, I'm sure you know the rest. It replicated itself. It did that also when I tried to rename it. Another symptom was that attempting to open the registry (either by double-clicking regedit or by entering 'regedit' in Run) resulted in the taskbar disappearing for a second or two - without registry editor ever running. I read numerous threads with similar problems and they all suggest the combofix method. I tried something else. I opened the infected file with wordpad, deleted all the contents and saved it with the same name. It didn't replicate itself, it shows 0 KB size (of course), and F-Secure doesn't recognize it as a virus (of course). Regedit works. Full system scan with F-Secure doesn't find anything anywhere. After a couple of reboots, nothing has changed. File still 0 KB, regedit works, no viruses reported. Is it safe to assume the problem is taken care of? I find it hard to believe - where is the initiator of the replication action? Is there a specific registry entry (or anything else) I should check to see if there is still an infection lurking? Thanks! __________________ -- Windows XP SP2, Desktop PC (HP), USB mouse, PS2 keyboard, 512 RAM, MSI-AMETHYST-M, AMD Athlon 64 3500+