Re: Got Alemon Trojan... deleted but can't change wallpaper

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Here's the information in the Virus Scan Report File

--------------------------------------------------------------------------------
Virus Scan Information
--------------------------------------------------------------------------------

McAfee VirusScan for Win32 v4.40.0
Copyright (c) 1992-2004 Networks Associates Technology Inc. All rights
reserved.
(408) 988-3832 LICENSED COPY - Sep 23 2004

Scan engine v4.4.00 for Win32.
Virus data file v4736 created Apr 07 2006
Scanning for 185597 viruses, trojans and variants.


--------------------------------------------------------------------------------
Virus Scan Results
--------------------------------------------------------------------------------




04/10/2006 06:18:36


Options:
/ADL /UNZIP /WINMEM /SUB /ANALYZE /PANALYZE /STREAMS /CLEAN /ALL /DEL
/PROGRAM /EXCLUDE C:\MCAFEE\EXCLIST.TXT /HTML C:\MCAFEE\NORMAL_SCANREPORT.HTML

Scanning C: []
Scanning C:\*.*
C:\WINNT\system32\taskdir.dll ... Found the Downloader-ZQ trojan !!!
The file or process has been deleted.

Summary report on C:\*.*
File(s)
Total files: ........... 162545
Clean: ................. 162497
Possibly Infected: ..... 1
Cleaned: ............... 0
Deleted: ............... 1
Non-critical Error(s): 2
Master Boot Record(s): ......... 1
Possibly Infected: ..... 0
Boot Sector(s): ................ 1
Possibly Infected: ..... 0


Time: 00:44.18



--------------------------------------------------------------------------------

Visit the McAfee Online Web Site
Need some help or advice? Send email to Technical Support. Normal file.
Still need to do the safe one.



I still can't get another background on my system. Just stays white. For
some reason it's looking for an html file, but I've checked the registry for
all suggestions and find nothing. Please help. Want to totally get rid of
this and get my background back.

Thanks.



"David H. Lipman" wrote:

From: "wyzard" <wyzard@xxxxxxxxxxxxxxxxxxxxxxxxx>

| Good evening.
|
| My system was infected with the Alemon trojan. I was able to delete it.
| All subsequent virus scans are showing up clean. This program changed my
| wallpaper to an .html file. I deleted the file, however now I just get a
| white background. I'm unable to change my wallpaper to anything else. I've
| looked at several instructions, but don't find the registery entries they are
| talking about.
|
| Can anyone provide me with some help on how I can change my wallpaper again.
|
| Thanks.


If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp


It is suggested that you execute the following tool in both Normal Mode and then in Safe
Mode.

Download SmitFraud.exe from the URL --
http://www.ik-cs.com/programs/virtools/SmitFraud.exe

Execute; SmitFraud.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


Please Copy and Paste the contents of the HTML Log files;
C:\mcafee\Normal_ScanReport.HTML & C:\mcafee\Safe_ScanReport.HTML in your reply.

* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



.

Relevant Pages

  • Re: Desktop display problem, but solutions not working
    ... but it couldn't find a backup WININT.dll or a McAfee ... Virus Scan Report File ... Scanning for 169582 viruses, trojans and variants. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: virus
    ... | pop up warning about I have this virus mentioned. ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ...
    (alt.comp.anti-virus)
  • Re: Partial Malware removal
    ... not a virus! ... On Win9x/ME platforms the report will not be shown in ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ...
    (microsoft.public.security.virus)
  • Re: Trojan.Vundo
    ... | I use Norton Antivirus and it show me a Trojan.Vundo virus in the following ... | connot detect the virus. ... It is suggested that you move the report out of c:\mcafee before performing another scan. ... It would be a good idea to scan in Safe Mode and in Normal Mode and save a copy of the HTML ...
    (alt.comp.anti-virus)
  • Re: SpySheriff
    ... | What to do to get rid of the virus? ... On Win9x/ME platforms the report will not be shown in your bowser ... It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML ...
    (alt.comp.anti-virus)