Posted 04 February 2007 - 01:19 PM
Had the same problem,
To correct it I did the following.
Installed AVG Anti spyware 7.5 from Grisoft, I used the free edition,
it is capable of finding the spyware, it claims it can remove it, however om my PC the trojan was immediatly back, still it is a one of the powerful tools against this trojan.
this was my trojan file:
C:\program files\1014d089\9CEB4757.DLL ( found with AVG anti spyware 7.5 free edition).
It can use different directories.
the directory is hidden and can by found with:
open a command box.
attrib "c:\program files"
you will find a hidden folder
type ( 1014d089 might be different In your case, I have seen 3 different directory names all similar ).
attrib -H "c:\program files\1014d089"
the directory becomes visible.
cd "c:\program files\1014d089"
attrib "c:\program files\1014d089"
you should see the actual trojan dll.
attrib -S -H -R "C:\program files\1014d089\9CEB4757.DLL"
it became visible for me.
If this file is removed by AVG or in any other way, it is recreated after a restart.
according to me this was on my PC done by 4 files, 3 DLL's and 1 executable.
the executable is a service, and the DLL's hide the same way as the trojan in the folder :
I made them visible with these commands:
attrib -S -H -R "C:\Program Files\Common Files\System\MS1014D0.DLL"
attrib -S -H -R "C:\Program Files\Common Files\System\MS1A9C88.DLL"
attrib -S -H -R "C:\Program Files\Common Files\System\MS5A2DCA.DLL"
these files I found by using ( sysinternals : ProcessMonitor, searching for 9CEB4757.DLL).
this are the only hidden DLL's in the folder c:\program files\common files\system
and last but not least.
i deleted the file :
it is installed as a service: with a name like "Advanced Server", it had a chinees description.
you can remove this from the registry by deleting this tree:
I did all deletions by first starting from a Windows PE CD, however it might also work in safe mode with dosbox
then deleted all DLL's and executables.
then I restarted normal windows,
and cleaned up the service list by deleting
It might by wise to search for sercurity.exe It is started from the registry, I removed that part with HIJACK.
This is no procedure an inexperienced user should try, but it solved it for me.
I hope others will benefit from it.