First - this is just for reference. Use any or all of this info AT YOUR OWN
RISK. I spent all day yesterday battling with a variant of a very nasty
trojan - one that you may or may not have. I REALLY hope you don't!! But
if you do have the one I had, it's a tough one to kill. These really are
just "notes" that I'm hoping may somehow help. I hope everyone will excuse
this long post and my lack of "more recent" common computer jargon. I'm an
old Novell guy.
---------------------------
The one I fought yesterday certainly was a malicious piece of garbage - the
one I had kept morphing so it was tough to remove. I fought with it for a
full day and *finally* got it subdued, using some tricks and Ad-Aware
version 6. But it was a monumental battle.
If you are pretty handy with Windows and registry editing, read further. If
not, you may want to call in expert help. You may just want to call in an
expert anyway. I can't guarantee that any of this will help you - but
perhaps this will be helpful in some way, shape or form. I'm not in any way
recommending that you follow these steps to try to get rid of your spyware -
but you can try them if you are about ready to reformat your entire drive
anyway.
Here are some things that I had to do to get rid of this beast:
First: - there's a service called something like "Network Security Service"
that I had to disable in the services. It was responsible for keeping the
evil registry keys in tact even when I deleted them. It's part of the
trojan setup.
In the registry file under the
HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
area I found 2 to 3 suspicious executable files that would not go away. I'd
delete them and within a few seconds they would be right back. Finally I
wrote executables (in of all things Microsoft QuickBasic 4.5!) matching the
names of these programs (executables that did nothing but do an old "print"
command) and placed them where the registry keys stated that the suspicious
executables were supposed to be. Oddly, the executables I thought I was
replacing weren't in those directories, but I had a strong feeling that
they'd be written to these locations when I shut down or started up - so
that they would conveniently load the trojan each time I booted my system.
My spyware infestation kept writing .dat, .dll and .exe files to the Windows
and Windows/System32 directory - hundreds and hundreds of them. Some were
set with system and hidden attribute flags on. I booted to safe mode and
moved all of these files to another drive. The files had different sizes
but were dated within the last month. Removing the right files and NOT any
system files that you need will take a skillful computer user so be
extremely careful if you try this. Most files had either 5 or 6 letters
before the file extension. Examples: xtrsvt.dll, pstd32.dll, xvrtm.dat,
etc. The characters were pretty random. Before i was done I had move over
6 megabytes of them - after zipping them up!! Many had a "32" at the end of
their prefixes.
There may have been entries in the RunOnce and RunOnceEx keys as well - I
don't recall but it would not surprise me.
Another thing of note - there were several suspicious processes running in
my task manager. I figured out which ones were causing my woes (some
matched the executables in my registry keys listed above) - but I could NOT
shut them down from within the task manager. Ack!
In my "Add/Remove Programs" I had a listing called "Home Search Assistent".
Note the misspelling. I tried to use this to remove any remaining garbage
but it does not work. I fear It's a permanent battle scar.
Here's a web site where I found some of these tips: This one was FULL of
info - and despair of a suffering victim.
http://www.computing.net/security/wwwboard/forum/12346.html
Here's another:
http://computercops.net/postp215213.html - I think this post is a bit
outdated as my variant kept writing new file names each time I'd find and
delete the old ones. But it mentions much of what I did to get my spyware
gone for good.
Here's another with a lot of info but it didn't help me - it may help you.
http://64.233.161.104/search?q=cach...guy.org/t235976.html+coolsearch+removal&hl=en
I hope this was helpful. Let me know. Believe me - if you have what I had,
I know what you are going through. Unfortunately, mine had infected a
Microsoft 2000 Small Business Server!! :-(
Nathan Brazil
