[Resolved] W32.Trats!inf virus removal

Ouch!!!

Don't give up yet. We are not.

10-4

Tonight or tomorrow at the latest.

Don't kill yourself trying for a reply today…I am tied up all day and won't be able to get near the infected machine until Sunday. wcosgroj

We are going to try and restore the registry keys that were deleted. This may enable you to get back into your system. Note: Your system is probably still infected but if we can get it going, we will have something to work with. Fingers crossed.


Note: This solution has been prepared for this particular user and should not be used on any other system without proper guidance. Failure to heed this warning may result in a damaged system.

1. Insert Windows Install disc to boot from CD.
2. Press any key on the keyboard when prompted.
3. Press R to load the Recovery Console.
4. Enter your password when prompted. (If you have no password, hit ENTER
5. You must enter which Windows installation to log onto. Type 1 and press enter.
6. At the C:\Windows prompt, type the following bolded text, and press Enter:

cd erdnt\Hiv-backup

7. At the next prompt, type the following bolded text, and press Enter:

C:\WINDOWS\ERDNT\Hiv-backup\erdnt.exe

8. The erunt backups will begin copying.
9. At the next prompt, type the following bolded text, and press Enter:

exit

Remove the CD from your drive and restart your machine.

If you get in and it reboots properly, please provide me with a fresh HijackThis log.

Good Luck

Trevuren, It did not work! At the prompt where I typed C:\ WINDOWS\ERDNT\Hiv-backup\erdnt.exe I get a message "the command is not recognized. Type help for a list of suggested commands" I tried to log on anyway after I typed "exit", but the same thing happened as before (it starts to log in then logs off immediately. I double checked all my typing and retried the fix several times, but to no avail. What next? wcosgroj

What was your command prompt? when you booted into the RC? Do you know how to change folders from the command prompt?

I have no clue what the command prompt was when I booted into the RC. I am hours away from getting back to the infected machine. Shall I retry and make note of that prompt? As to the other question (about changing folders), since I don't know what you're talking about, I'll have to say no. wcosgroj

Try this: (slightly different than the last procedure)

1. Insert Windows Install disc to boot from CD.
2. Press any key on the keyboard when prompted.
3. Press R to load the Recovery Console.
4. Enter your password when prompted.
5. You must enter which Windows installation to log onto. Type 1 and press enter.
6. At the C:\Windows prompt, type the following bolded text, and press Enter:

cd erdnt\hiv-backup

Next prompt, next command:

batch erdnt.con

Files should begin copying.

Next prompt, Exit


Also, please tell me if you have other removable media drives other than that one CD drive.

Trevuren, Thanks…I'll try it soon. No other external drives connected to the machine at this time, though I sometimes use a sandisk card reader to load photos from my digital camera, and I sync my Palm Treo occasionally via a cable. wcosgroj

Trevuren, I'm in!!! I am sending this from the infected computer. What do I do next? If you want one of those Hijack This logs, refresh my memory how to do that, please. wcosgroj

1. First, I would like for you to download & run this file :> http://download.bleepingcomputer.com/sUBs/grab.exe

Grab.exe is an exploratory tool for troubleshooting ComboFix issues. What it'll do is search your machine for the C:\ComboFix folder & when found, will create a zip file comprising of files from the C:\ComboFix folder. This zipped file shall be named _sUBs-.zip & should be located on your Desktop. I shall need for you to upload this file to > http://www.bleepingcomputer.com/subm….php?channel=4

Hopefully, from those files the developer of the tool can find out what went wrong. Tell me as soon as the info has been sent.


2. Post a fresh HijackThis log


3. Now that we know that you can get back in, we have to find out if you can get back in every time without the RC. So we take out the Installation CD and turn off the machine. Then restart the machine and see if you can get back in without the installation CD.

I have submitted the grab file to Bleeping Computer. I will now post a new HJT log…can I use the link from before to run that?

Well done Yes, running the same version of HiJackThis.exe shlould be fine