Printable Version of Topic

Click here to view this topic in its original format

BleepingComputer.com _ Am I infected? What do I do? _ Trojan Infection But Can Not Access Internet For Help

Posted by: crystal_june Sep 15 2007, 12:52 PM

I have CATSRVPS.EXE on my computer. Some of the other words that go with it in the "virus notice" box are: c:/windows/system 32 and downloader.BEl.d11 I tried to run Ad Aware but it got hung up at this virus. Ad Aware said that this program is not cleanable or delete-able. I found the topic here on how to remove this program but I can not access the internet on that computer to get what you are recommending to help clean my computer. Also, I have Windows XE and the only options I get when I start up are F1: Setup and F12: Boot. I do not know any other way to get to safe mode. As you can tell, I am fairly computer illiterate. Any suggestions?

Posted by: buddy215 Sep 15 2007, 01:33 PM

Quote: "Also, I have Windows XE"---could this be a typo? XP, maybe?

You need to download Super Antispyware to another medium (CD, flash drive) using another computer then install on the infected computer.
Install Super Antispyware. Allow it to quarantine whatever it finds.
http://www.superantispyware.com/

Let us know the results of the scan. Also, give us the link to the instructions that you found on this site to remove the malware you have.

Posted by: crystal_june Sep 16 2007, 12:07 AM

Yes, I have Windows XP, not XE oops.

Here is the link that I found that you requested...
http://www.bleepingcomputer.com/tutorials/tutorial101.html

I got the SuperAntiSpyware, installed it on the infected computer and.. it scanned right over catsrvps.exe It did however give me a way to reboot in safe mode, so I will try to do something with that tomorrow. The SuperAntiSpyware did find things to remove on my laptop, so I know I DID get it downloaded correctly.

Anything else that I need to try?

Thanks for your help.

Posted by: buddy215 Sep 16 2007, 07:11 AM

Install the Hijack This program the same way you did SAS. When you have HJT on the infected computer and before you install it/use it, find the HJT.exe file and right click on the file. Choose "rename" and name it lastchancescan.com.
http://www.bleepingcomputer.com/files/hijackthis-installer.php
Post a Hijack This Log in the Hijack This Forum by following the directions in the link below. DO NOT post a log in this forum.