July/August-Norm-Joopson - Page 4 - Simply Maya User Community

# 46 04-08-2006 , 09:58 PM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

ok, i have a small virus(that i will delete(but cant figure out how yet)) so i will post the first pic soon, then there will be a delay while i remove the virus.

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 47 04-08-2006 , 10:13 PM

Registered User
Join Date: Apr 2005

Location: Fairfield, CT

Posts: 2,436

I could help you, what do you think you have? Could you tell me what scans you ran? And what the outputs were???? my dad's a computer security specialist user added image

i can't help but pick up some stuff. I actually managed to clean my computer of Win AntiVirus Pro 200 (bad bad spyware) all on my own user added image

Oh- and never actually physically delete any file (especially if it's in system32, that will only remove traces of the virus, the registry changes and autolaunch datas are still there, and the virus itself will still run. if not, then your computer could hang and/or bluescreen)

Live the life you love, love the life you live

Quote

# 48 04-08-2006 , 11:34 PM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

umm, the virus is called Trojan.Zlob
it is located in c:\WINDOWS\TEMP\

i have run nortons, ATF-cleaner, Ad-aware,Ewido,NOD32, HijackThis, SmitRem, Spybot, and a few others.

however, this file duplicates when i delete it...... wierd............. ummm, i dont have any of the output things yet from the scans, because i forgot to tell the programs to make them.....

i will run some scans and make them output a text file...

thanks in advance,
-andy

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 49 04-08-2006 , 11:39 PM

Registered User
Join Date: Apr 2005

Location: Fairfield, CT

Posts: 2,436

Trojan.zlob has to be the worst backdoor trojan in a while. I picked it up and the only option was to wipe my hard drive clean. Also, it's probably not only Trojan.Zlob. It's what's called a blended threat, usually coming alongside a few other trojans and spywares.

here's what another site says about how to remove it

"Trojan.Zlob.F removal procedures requires technical know-how on computer troubleshooting. It is better to consult your LAN Administrator or Technical Persons to avoid additional damage on your computer if modifications on Services and Registry have to be done.

MANUAL REMOVAL:

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files detected.
4. Delete any values added to the registry.

Navigate to the subkey and delete value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run
Value: "nvctrl.exe" = "nvctrl.exe"

Navigate to and delete the following subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{724510C 3-F3C8-4FB7-879A-D99F29008A2F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects
\{724510C3-F3C8-4FB7-879A-D99F29008A2F}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objecta
\{724510C3-F3C8-4FB7-879A-D99F29008A2F}

5. Exit the Registry Editor.

***If it makes changes to Windows registry that may prevent you from running executable files. A tool to reset registry values to the default value is available for download. Click Here.

6. Reset the Internet Explorer home page.

a) Start Microsoft Internet Explorer.
b) Connect to the Internet, and then go to the page that you want to set as your home page.
c) Click Tools > Internet Options.
d) In the Home page section of the General tab, click Use Current > OK.

7. Reset the Internet Explorer search page.

a) Start Microsoft Internet Explorer.
b) Click the Search button on the toolbar.
c) In the Search pane, click Customize.
d) Click Reset.
e) Click Autosearch Settings.
f) Select a search site from the drop-down list, and then click OK.
g) Click OK.

8. In order to make sure that trojan zlob.f is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with an Online Virus Scanner."

Live the life you love, love the life you live

Quote

# 50 04-08-2006 , 11:44 PM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

thats what is says on nortons site, and am doing that as we speak... thanks! user added image

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 51 04-08-2006 , 11:46 PM

Registered User
Join Date: Apr 2005

Location: Fairfield, CT

Posts: 2,436

also, see these links:

https://www.sophos.com/security/analyses/trojzlobjw.html

(I trust sophos, so if you have to get the 30 day demo and remove the virus)

also, before i ask anything else, did u post anything at the pcpitstop forums????

Live the life you love, love the life you live

Quote

# 52 04-08-2006 , 11:47 PM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

umm, i posted something on a site made by the same people..... tomcoyote.com?

anyway, thanx for your help, i hope this works

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 53 04-08-2006 , 11:52 PM

Registered User
Join Date: Apr 2005

Location: Fairfield, CT

Posts: 2,436

ok, well if it doesnt work, try the sophos link, also go to these, it might help

https://www.pcpitstop.com/antivirus/

also,

https://www.pandasoftware.com/product...ACHEHINT=Guest

(you have to do it in internet explorer, and fill in all your info, allow all active x controlss, etc...)

Live the life you love, love the life you live

Quote

# 54 05-08-2006 , 12:09 AM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

i have used the panda thing already, i will see about the other thing

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 55 05-08-2006 , 12:52 AM

Registered User
Join Date: Apr 2005

Location: Fairfield, CT

Posts: 2,436

any luck?

Live the life you love, love the life you live

Quote

# 56 05-08-2006 , 01:11 AM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

not yet, i am running SOPHOS still

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 57 05-08-2006 , 03:46 AM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

ok,first pic

Attached Thumbnails

Click image for larger version

Name: start.jpg
Views: 216
Size: 57.0 KB
ID: 30069

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

# 58 05-08-2006 , 12:14 PM

Registered User
Join Date: Apr 2005

Location: Fairfield, CT

Posts: 2,436

that looks pretty cool, I guess its a good first start user added image

Live the life you love, love the life you live

Quote

# 59 05-08-2006 , 12:41 PM

Subscriber
Join Date: Jul 2004

Posts: 1,257

nice start Joopson,

are we going to see this one complete? user added image

I hope your computer's fit and well now.

Take it easy,

Mat

Quote

# 60 05-08-2006 , 05:04 PM

Registered User
Join Date: Jul 2005

Location: Boston, MA

Posts: 2,314

lol, yeah, i will finish this one.

but my computer still has the virus.. hopefully it will be gone if i follow the above instructions....

thanx,
Andy

Environment Artist @ Plastic Piranha
www.joopson.com

Quote

Posting Rules Forum Rules

Similar Threads

Topics

Free Courses

Full Courses

VFX News