Trojan worm... computer reboots itself - DFWstangs Forums
 
LinkBack Thread Tools Display Modes
post #1 of 16 (permalink) Old 04-17-2007, 10:25 AM Thread Starter
Packin' up...
 
Skidmark's Avatar
 
Join Date: Jul 2003
Posts: 18,736
Trojan worm... computer reboots itself

My parents computer has a Trojan worm (zhelatin) in it. Once you turn it on it will go to the windows welcome screen and reboot itself.

I was able to get into windows through safe mode, turn off system restore so it doesn't spread, and do a scan with AVG. It found the worm and deleted it, but the problem stays.

I restored back to a known good spot and it still will reboot itself.

Any ideas? I'm stuck on this one...

Thanks, Brien
Skidmark is offline  
Sponsored Links
Advertisement
 
post #2 of 16 (permalink) Old 04-17-2007, 10:34 AM
Moved to dfw mustangs.net
 
lowthreeohz's Avatar
 
Join Date: Oct 2002
Location: Hurst-Useless-Bedford area
Posts: 20,572
"zhelatin + removal" in google will find you an answer.
lowthreeohz is offline  
post #3 of 16 (permalink) Old 04-17-2007, 12:35 PM
Googlist-Wikipedian
 
Hunt4m3x's Avatar
 
Join Date: Jul 2002
Location: de_aztec
Posts: 4,814
http://www.f-secure.com/v-descs/emai...latin_cq.shtml

2005 Infiniti G35 Sedan Ivory Pearl Premium

2006 Infiniti FX45 Liquid Platinum

2010 Polaris Ranger RZR S Orange Madness







Ban count: 2
Hunt4m3x is offline  
 
post #4 of 16 (permalink) Old 04-17-2007, 09:02 PM Thread Starter
Packin' up...
 
Skidmark's Avatar
 
Join Date: Jul 2003
Posts: 18,736
I still can't get it off!
Skidmark is offline  
post #5 of 16 (permalink) Old 04-17-2007, 09:16 PM
Rockin' da fumanchu
 
Join Date: Nov 2005
Location: On the straight and narrow,stumbling at best, only by Gods grace.
Posts: 7,224
http://usa.kaspersky.com/trials/tria...pter=146481750

If this won't get rid of nothing will.





Listen to my buddy, Jeff Bolton, from 6-9 AM Mon-Fri.

Obamanomics = Trickle Up Poverty

Think you need to format/reinstall your OS(XP), read this first.
Tx Redneck is offline  
post #6 of 16 (permalink) Old 04-17-2007, 09:17 PM
Time Served
 
Join Date: Apr 2003
Posts: 531
Try turning off the RPC protocol. Restart in safe mode, right click on "my computer", go to "manage", click "services and applications", click "services", scroll down to "Remote Procedure Call". Highlight it with a single left click, then do a single right click, you should see a menu drop down, go to properites and click on the "Recovery" tab. You will see three drop down boxes, make sure they are set at "take no action". If they are not then set them and click "OK". Do that for both RPC features (they are on top of each other in the system menu). That should fix the rebooting until you can complete the removal.

I am assuming this is an XP system?

Eric

93 Black Mustang GT

post #7 of 16 (permalink) Old 04-17-2007, 09:21 PM Thread Starter
Packin' up...
 
Skidmark's Avatar
 
Join Date: Jul 2003
Posts: 18,736
Quote:
Originally Posted by Tx Redneck
http://usa.kaspersky.com/trials/tria...pter=146481750

If this won't get rid of nothing will.
I just got the program installed and scanning... so far 28 files of zhelatin.

Quote:
Originally Posted by [email protected]
Try turning off the RPC protocol. Restart in safe mode, right click on "my computer", go to "manage", click "services and applications", click "services", scroll down to "Remote Procedure Call". Highlight it with a single left click, then do a single right click, you should see a menu drop down, go to properites and click on the "Recovery" tab. You will see three drop down boxes, make sure they are set at "take no action". If they are not then set them and click "OK". Do that for both RPC features (they are on top of each other in the system menu). That should fix the rebooting until you can complete the removal.

I am assuming this is an XP system?

Eric
Yes this is home XP... I will try that next if this program will not solve the issue
Skidmark is offline  
post #8 of 16 (permalink) Old 04-18-2007, 12:34 AM
Time Served
 
Join Date: Apr 2003
Posts: 531
That program should work. I would diable the auto restart in the RCP anyways, just in case you get something in the future. The auto restart is a very common bug.

Eric

93 Black Mustang GT

post #9 of 16 (permalink) Old 04-18-2007, 08:32 PM
Rockin' da fumanchu
 
Join Date: Nov 2005
Location: On the straight and narrow,stumbling at best, only by Gods grace.
Posts: 7,224
Did that fix it?





Listen to my buddy, Jeff Bolton, from 6-9 AM Mon-Fri.

Obamanomics = Trickle Up Poverty

Think you need to format/reinstall your OS(XP), read this first.
Tx Redneck is offline  
post #10 of 16 (permalink) Old 04-19-2007, 07:39 AM Thread Starter
Packin' up...
 
Skidmark's Avatar
 
Join Date: Jul 2003
Posts: 18,736
I put their HD in my PC and scanned it with Kapersky. It found and deleted the worm...

I also set the RPC to do not take action and it is still rebooting itself.
Skidmark is offline  
post #11 of 16 (permalink) Old 04-19-2007, 09:18 AM
Time Served
 
Join Date: Apr 2003
Posts: 531
You set both RPC's to take no action on all three menu's? You might just have to back up what you can and do a format and reinstall.

Eric

93 Black Mustang GT

post #12 of 16 (permalink) Old 04-19-2007, 09:21 AM Thread Starter
Packin' up...
 
Skidmark's Avatar
 
Join Date: Jul 2003
Posts: 18,736
Quote:
Originally Posted by [email protected]
You set both RPC's to take no action on all three menu's? You might just have to back up what you can and do a format and reinstall.

Eric
I think that's gonna be my best bet... thanks for the help guys
Skidmark is offline  
post #13 of 16 (permalink) Old 04-19-2007, 02:22 PM
IA2
 
mikeb's Avatar
 
Join Date: Mar 2001
Posts: 22,413
If you can get it on the net in safe mode (or with their drive in your box) try the trendmicro scan. It gets a lot of stuff that others miss.

www.trendmicro.com

Click on online services and use the online housecall button.
mikeb is offline  
post #14 of 16 (permalink) Old 04-19-2007, 05:24 PM
Lifer
 
JACKASS RACING's Avatar
 
Join Date: Jul 2006
Location: rockwall,TX
Posts: 1,342
wow,i know who to pm when my pc screws up.....all the previous post read just like chinese arithmatic.......

previously known as bgnracing...now defunct
JACKASS RACING is offline  
post #15 of 16 (permalink) Old 04-19-2007, 05:29 PM
Semi-Banned
 
Stng5Pnt8's Avatar
 
Join Date: Nov 2002
Location: Dallas Tx. 75227/Grand Prairie 75052
Posts: 6,602
Quote:
Originally Posted by mikeb
If you can get it on the net in safe mode (or with their drive in your box) try the trendmicro scan. It gets a lot of stuff that others miss.

www.trendmicro.com

Click on online services and use the online housecall button.

another vote for Trendmicro, I use Trendmicro for our computers at the office and it works GREAT!!
Stng5Pnt8 is offline  
post #16 of 16 (permalink) Old 04-19-2007, 07:04 PM
Rockin' da fumanchu
 
Join Date: Nov 2005
Location: On the straight and narrow,stumbling at best, only by Gods grace.
Posts: 7,224
Quote:
Originally Posted by Stng5Pnt8



another vote for Trendmicro, I use Trendmicro for our computers at the office and it works GREAT!!
That's what I use personally but Kapersky has the best detection/removal of all antivir programs out.





Listen to my buddy, Jeff Bolton, from 6-9 AM Mon-Fri.

Obamanomics = Trickle Up Poverty

Think you need to format/reinstall your OS(XP), read this first.
Tx Redneck is offline  
Sponsored Links
Advertisement
 
Reply

Bookmarks

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the DFWstangs Forums forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode



Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome