UNSOLVED
Trojan
I have 2 trojans I picked up.
TROJ NUKERBSLAP in C:\_RESTORE\ARCHIVE\FSID10.CAB
Can't think of the other one, How do I go about getting rid of it? I deleted it out of my folder and InnoculateIt doesn't see it. I went to PCCillen and that's what detected it. I can't find it in any folders anymore but, PCCillen shows it there. Do I have to do a reformat?
For some reason only this one above is there now. It says "cannot access" when I try to clean it from pccillen's site.
TROJ NUKERBSLAP in C:\_RESTORE\ARCHIVE\FSID10.CAB
Can't think of the other one, How do I go about getting rid of it? I deleted it out of my folder and InnoculateIt doesn't see it. I went to PCCillen and that's what detected it. I can't find it in any folders anymore but, PCCillen shows it there. Do I have to do a reformat?
For some reason only this one above is there now. It says "cannot access" when I try to clean it from pccillen's site.
Hi,
Since you have an antivirus program installed on your system, I would recommentd that you go to TrendMicro's HouseCall free online scanning service. They do have a description of the one Trojan you mention, and may be able to clean both it and the other out for you. Their description of the nukerbslap trojan is here.
HTH,
Kay
Hi,
Really, it was no problem at all; it's all useful at some point or other, and I'm just happy you were able to get rid of it without reformatting, since now is not a good time for it.
Have a good one, and thanks for adding your experience--I'll keep the posts for if someone else needs help on this trojan :)
Kay
Hi,
Depending on the trojan, many of them can be cleaned up manually without reformatting, but you need instructions to do it. When you aren't able to clean this file because it's supposed to be in use, does HouseCall tell you how to go about cleaning it? I suspect it would be possible to boot up with an ME emergency boot disk and extract the file from the .cab file where they say it it currently located, if Windows won't let you get rid of it. You deleted the file once, then scanned the system, and were told that it is still there? If true, then it sounds like the system wasn't completely clean and has replaced the file.
With this trojan, only the TrendMicro site has any description at all, and no one is offering manual instructions for its removal. TrendMicro and PCcillin both want to remove it using the AV scan.
This said, then, if you cannot clean the trojan, including this file, using the TauScan, then, if needed, this article tells you how to extract files from .cab files.
Once TauScan finishes, see what it says about whether the system is cleaned up; you might want to verify that this file is not present in the .cab file yourself, where you knew it has been there in the past. If it's there, delete it, if Windows allows you access, and use the extraction instructions if it does not.
Are you able to clean the other trojan up all right?
Kay- Yea, deleting it took the first trojan out with no problem. Housecall said it couldn't delete the second one because it was in use. It didn't give me any other advice. So I tried booting to backup floppy and deleting that way. Couldn't find it. So the only thing I could think of was I forgot to delete my cookies. Did another scan and am good to go! I thought trojans were no big deal, just delete and no problem. I completely forgot about the cookies tho. :D
I really appreciate all the research you did for me tho. I know it's not easy Thanks again! - Thanks Pamela. I accidentaly called Housecall, PCcillen. I have InnoculateIt for virus protection. I would have been ok if only I would have remembered to delete my cookies. That's why I started to worry about having to reformat because I thought all you had to do to a trojan was delete it. So I thought it was some new thing I never heard of. I didn't know about the proper way that System Restore went about it's business. Thanks for letting me in on the info for that.
DeBug
33 Posts
427
0
Posted March 29th, 2001 02:00
That's where I got my scan at and it said that it can't delete it because the files in use. I'm doing a Tauscan right now and the first time it didn't come up with anything. But, Pccillen still did. So I modified the search with Tauscan and am in the process right now.
Is it possible to get rid of a trojan w/o reformatting? I just don't want to have to lose everything.