Solved

How to effectively remove Malware in Win2K

Posted on 2004-08-25
4
194 Views
Last Modified: 2010-04-14
Hi, we've been attacked by malware (I think); everytime I think I found where it lives; it's back again.
registry hacks to HKLM\SOFTWARE\MICROSOFT\WINDOWS\Currentversion\Run don't to work because
they get reloaded. Some of the files installed by this attack are:

mt.exe (redirects browser to porn site)
winupd.exe
svchosts.exe

these files are randomly seeded throught the OS

on the root of c:\ it sometimes adds:
Java.exe
bar.exe
bars.exe

on network servers; administrative shares get removed

I think these symptoms may also apply to W32.spybot.worm.

PLEASE HELP! :)

thanks,
NT
0
Comment
Question by:NTucci
  • 2
  • 2
4 Comments
 
LVL 17

Expert Comment

by:Microtech
ID: 11892828
Hi NTucci,

experts have put a pge together just for this solution at http://www.experts-exchange.com/Web/Browser_Issues/Q_20975384.html

Hope This helps
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11892834
Hi NTucci,

You can find a list of tools here:
http://www.experts-exchange.com/Q_20975384.html

I suggest you to run at least Ad-aware fully updated on the troubling computers.
And run stinger from http://vil.nai.com/vil/stinger/ to get rid of the spybot worm.

Make sure that you do both in safe mode and without any connection to the network to prevent the system from infecting others.

If that doesn't help, get yourself hijackthis and post the logfile it creates here so we can take a look at it.

Greetings,

LucF
0
 
LVL 32

Expert Comment

by:Luc Franken
ID: 11892840
nice timing Microtech :)
0
 
LVL 17

Accepted Solution

by:
Microtech earned 500 total points
ID: 11892896
thanks... not on the decaff today
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

What does UTC stand for?  “Coordinated Universal Time” – Think of this as the true time on Planet Earth that never changes with the exception of minor leap seconds here and there to account for the changes in the planet's rotation.   What does th…
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now