[Rodster]

My desktop had a trojan virus. I got it cleaned and scanned the computer with two different programs.
I am sending this from my laptop to be safe.

Now I am having this problem. When My computer boots it is looking for a file. It shows in MS config.
I deleted the EXE files from my start up and then went to MSconfig and they were there. I removed the x from the box on the bad EXE files. But every time I reboot it creates more or puts an X in the box so that when it boots up Windows is looking for the EXE files but can't find them because they are gone. I can't find the program that is trying to launch them. If you have any ideas please let me know. I also can't find a way to delete them from MSconfig. When I follow the path to where these programs are supposed to be they are not there. I think the Trojan virus created them and the anti virus program deleted them but Windows keeps looking for them. Outside of that the computer works fine ounce I shut down the little flashlight that is looking for the EXE files. I scan with current PC-cillin and even went online to scan from their site. All shows good.
The name of the Trojan was Trog_revop.A It was caught and put in quaranten and then I deleted the file.
Any help welcome
Rodster

 

[guest]

What was the executable file rod?
Are you running win XP. I know MS config does not work in windows XP like it did in 98.. in 98 you can uncheck the pgm to run.. but with XP when you say to boot normally it puts the X back on the pgm.
I posted a questin on this to a microsoft help newsgroup and they said that its working as it should.. that you are supposed to go in and remove the executable file via uninstall...

if you know the executable files.. can they be ininstalled?

 

[dougand3]

There is a freeware program that works better than msconfig...Startup Cop

 

[Rodster]

Here are the files.
I am not sure but I think the Trogen created them.
MORZE5.EXE
4lNKD2HO.EXE
N8FAKNVD.EXE
XVCUKJK1.EXE
ZDFU14G4.EXE
ZMOWM94Z.EXE
MOCYCBHB.EXE
They have a filepath to Windows( C:/ windows xxxxxx)

My desktop runs Windows 98

 

[dougand3]

Try opening

1. config.sys
2. autoexec.bat

with notepad. These 2 files are TEXT ONLY. They sometimes run instructions before windows boots up. See if any lines point to these exe files or copy the text from them and post here.

 

[guest]

so your pc is windows 98?

do you get an error saying trying to load a file but can not find it? if so, Whats the name of that file its trying to load??

are you tring to see where that file or program is being called from? did you check your startup folder is it calling it from there?

when i ran 98 i was able to uncheck files at startup and they would not reload...

 

[Rodster]

Try opening

1. config.sys
2. autoexec.bat

with notepad. These 2 files are TEXT ONLY. They sometimes run instructions before windows boots up. See if any lines point to these exe files or copy the text from them and post here.

============================================
How do I access them? I have scanned with different anti virus programs and the latest scrubbers. It shows clean but ounce it goes online the trouble starts again. It keeps adding short cut EXE programs. Popups and slows to almost stopping.
Rodster

 

[dougand3]

My computer>C: drive. This shows your root directory. You should see autoexec.bat and config.sys.

If you don't...Go to Tools>folder options>view and

check "Show Hidden Files and folders"
uncheck "hide protected system operating files"
uncheck "hide extensions for known file type"

Rightclick autoexec.bat. Edit.The batch code lines will come up in notepad. Copy and paste here.

Same for config.sys


Next thing to check is what loads with windows.

Start>Run>msconfig>ok>startup

List everything checked here. Best for troubleshooting this is to uncheck EVERYTHING except scanreg>apply>ok>restart

Although if you feel you gotta have antivirus going, leave it checked, too

 

[tisenberg]

Ok, so let me get this straight. You are getting an error about finding a file. At what point is this happening? If the error is during the black and white text part of the computer booting, the problem is related to something in config.sys or autoexec.bat (probably). If it happens before the initial login box of the Windows (during loading of windows), it is probably something related to Windows loading (system.ini, registry, etc). If it is *after* you log in, it may be something from win.ini, registry or from a startup folder.

Please provide the visual information, what happened, when it happened and the specific error provided.

This should put us on the track to solving the problem. Hope to help you get this resovled soon!

 

[Rodster]

tisenberg
AS soon as windows boots up I get the little flashlight saying that is is looking for a certain file. The shortcut to the nonexistant file will be in MSconfig. If I go into msconfig and uncheck it ( actually more than one of these EXE files) it will recheck them after rebooting again.
I am going to do what Doug said and will report back.
Rodster

 

[Rodster]

Hi Doug
I must be missing something or old age kicking in.

In C drive I have autoexc and autoexc.cam ( no autoexc.bat )

I also can't find config.sys

Where do I find tools?

In msconfig I can't find a way to copy the startup programs.


Lost Rodster

 

[bigl22]

in w98 tools is accessed for easy tasks thru start - prgrams- accessories - system tools - unplug the thing from the I-net modem /. phone hookup if you suspect it is accessing i-net faster than you can deal with it and work on it - no connection - no new infection -- bigl22

 

[dougand3]

In C drive I have autoexc and autoexc.cam ( no autoexc.bat )

You may not have it...not a requirement to run.

Highlight autoexec.cam>rightclick it>open with notepad>copy and paste here.


I also can't find config.sys

You may not have it...not a requirement to run.

Where do I find tools?

When you are looking at C: directory, it's at the top beside Help

In msconfig I can't find a way to copy the startup programs.

I can't either...must physically copy on paper and type in thread


Let's try this....

Restart puter
Press ctrl - alt - delete at the same time
One at a time end task all running programs except Explorer and your antivirus program (Highlight program - press End Task -you may have to do it 3 times for each one)
When ONLY Explorer and your antivirus program are left in the ctrl-alt-del window...cancel the window and try your internet.

 

[Rodster]

Hi Doug
I downloaded the most up to date scrubber from Trend. That is what anti virus I am running. This is something besides a update.
I had to download it then get Winzip and unzip it to overwright
the old scrubber.
All was looking good. It did not search for missing files and online no slow down or pop ups. Then I get a virus warning. It was another Trojan ( different name this time ) It was unale to clean so it quarantened it. I halted internet traffic and went in and deleted the file. This is the same thing that started my problems before. I am rescanning it now but I did the same thing when I got the last one and it scanned clean. I will let it scan and try it again. Also today I set my firewall to max security setting.
I will report back. My desktop is a few years old with win 98.
I am about ready to go out and buy a Macintosh. Those people laugh at Windows machines.
Rodster ( using my laptop XP machine again)

 

[Rodster]

When I first got to the Keys I got hit with the MS Blast virus the first 5 minutes I was online. It took me most of a day to get rid of it. But that was nothing compared to this. I could just reformat the hard drive but that would be too easy. HA HA
Frustrated in Michigan
Rodster ( a low tech guy in a high tech world )

 

[memmurphy]

I had to run the AV scan once while in "Safe Mode" to get rid of a Trojan. This was at work on an Win XP machine though. Once XP executed the file it would not let the AV touch it.

Mark

 

[Rodster]

Hi Doug
I guess the last Trojan to hit me was caught by my anti virus. So far I am running good. I took 3 pictures of my start up folder
in MSconfig with my digital camera. I had to take 3 to get them all in. I will sent one picture in 3 seperate posts. Some of the bad
exe files are still in there but remain unchecked so they don't try to load. They are the ones with just a bunch of random letters followed by the .EXE. Here is the first picture.
Rodster

 

[Rodster]

Here is the second picture

 

[Rodster]

Here is the 3rd picture.
Rodster

 

[dougand3]

Rodster, good thinking with the digital camera!

However, it would be helpful to see the full directory location...the C:\program files\etcetc

Then, we would know what to delete

You have a TON of stuff loading with windows...too much

The only thing I see that really really ought to be loaded is "Scanregistry"....MAYBE the ATI video card stuff (doubtful unless you tweak your display setting alot)....MAYBE the iomega zip disk stuff (unsure if required to load for functionality)

You have spyware...backweb, watchdog....Spybot will eradicate this...download it, install and run.

http://download.com.com/3000-2144-10194058.html?tag=lst-0-1

Now, I would try unchecking every msconfig item EXCEPT "scanregistry". Don't worry, it won't hurt a thing...if something doesn't function right, recheck that item and reboot.