My parents computer has a Trojan worm (zhelatin) in it. Once you turn it on it will go to the windows welcome screen and reboot itself.

I was able to get into windows through safe mode, turn off system restore so it doesn't spread, and do a scan with AVG. It found the worm and deleted it, but the problem stays.

I restored back to a known good spot and it still will reboot itself.

Any ideas? I'm stuck on this one...

Thanks, Brien

"zhelatin + removal" in google will find you an answer.

http://www.f-secure.com/v-descs/emai...latin_cq.shtml

I still can't get it off!

http://usa.kaspersky.com/trials/tria...pter=146481750

If this won't get rid of nothing will.

Try turning off the RPC protocol. Restart in safe mode, right click on "my computer", go to "manage", click "services and applications", click "services", scroll down to "Remote Procedure Call". Highlight it with a single left click, then do a single right click, you should see a menu drop down, go to properites and click on the "Recovery" tab. You will see three drop down boxes, make sure they are set at "take no action". If they are not then set them and click "OK". Do that for both RPC features (they are on top of each other in the system menu). That should fix the rebooting until you can complete the removal.

I am assuming this is an XP system?

Eric

I just got the program installed and scanning... so far 28 files of zhelatin.

Yes this is home XP... I will try that next if this program will not solve the issue

That program should work. I would diable the auto restart in the RCP anyways, just in case you get something in the future. The auto restart is a very common bug.

Eric

Did that fix it?

I put their HD in my PC and scanned it with Kapersky. It found and deleted the worm...

I also set the RPC to do not take action and it is still rebooting itself.

You set both RPC's to take no action on all three menu's? You might just have to back up what you can and do a format and reinstall.

Eric

I think that's gonna be my best bet... thanks for the help guys

If you can get it on the net in safe mode (or with their drive in your box) try the trendmicro scan. It gets a lot of stuff that others miss.

www.trendmicro.com

Click on online services and use the online housecall button.

wow,i know who to pm when my pc screws up.....all the previous post read just like chinese arithmatic.......

another vote for Trendmicro, I use Trendmicro for our computers at the office and it works GREAT!!

That's what I use personally but Kapersky has the best detection/removal of all antivir programs out.