Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Labor Day Virus - Help Infected....


  • Please log in to reply
3 replies to this topic

#1 tmparsley

tmparsley

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:30 AM

Posted 06 September 2007 - 06:17 AM

Can you help us get one of our computers that got infected with this Happy Labor Day Virus...

Now we can't get to the internet....

Any suggestions?

THANKS! TINA

BC AdBot (Login to Remove)

 


#2 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:30 AM

Posted 06 September 2007 - 06:31 AM

Hello Tina and welcome to BleepingComputer.
This infection allows hackers to remotely control your computer, steal critical system information and download and execute files. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall?
The choice is entirely up to you ...
If you decide you would like to try to remove this infection from your computer, please follow the steps outlined below.

******

Firstly, we need to try to get your internet access back. The trojan is known to modify the registry so that you cannot accesss the internet, so we will try to re-enable it for you. Before we do this, we need to make a backup incase anything goes wrong.
Navigate to Start | Run and paste the following:regedit /e c:\registrybackup.reg
Now click OK
It won't appear to be doing anything, that's normal.
Your mouse pointer may turn to an hour glass for a minute.
Please continue when it no longer has the hour glass.

Open Notepad and copy and paste the following quotebox into a new text document. (Don't forget to copy and paste REGEDIT4!)

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Start" = "2"

Save this as fix.reg Choose to save as *all files and place it on your Desktop.
It should look like this: Posted Image
Double-click on it and when it asks you if you want to merge the contents to the registry, click Yes/OK.

After this, please follow our Preparation Guide For Use Before Posting a HijackThis Log; running all of the scans before posting your HijackThis log. Do not post your log here, but instead use our HijackThis Log and Analysis Forum.
After posting a log you should NOT make further changes to your computer except those that are advised by a member of the HijackThis Team; doing so can cause system changes that may not be visible in your log. Please be patient whilst waiting for a response, our HJT Team is currently very busy, and as we try to deal with logs on a "first come first served" basis, you may have to wait a short while.

Edited by rookie147, 06 September 2007 - 06:32 AM.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image


#3 tmparsley

tmparsley
  • Topic Starter

  • Members
  • 52 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:30 AM

Posted 06 September 2007 - 06:43 AM

THANKS Rookie,

after I do the Fix Reg file, will I be able to get to the computer using that computer? Actually it was my mom's computer, but she is in the same town as me. I am probably going to have to work using a flash drive in the meantime, until i get internet access to her computer.

(the bummer is I just bought her this computer, less then a year ago!) She only uses it to surf the net and play games. I am positive she doesn't use it for any banking or anything too serious.

I'll keep you posted,
thanks again!
Tina

#4 rookie147

rookie147

  • Members
  • 5,321 posts
  • OFFLINE
  •  
  • Local time:09:30 AM

Posted 06 September 2007 - 07:45 AM

The reg fix should grant her access to the internet again, thus enabling you to follow the preparation guide using her computer. There may be other reasons why she cannot access it at the moment, but I think it is probably caused by the trojan she has, so hopefully it will work again afterwards.

EDIT: Typos

Edited by rookie147, 06 September 2007 - 07:46 AM.

If you are pleased with the service I have offered, you may like to consider making a donation. Posted Image
Posted Image





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users