how to remove backdoor.blarul

mikegm · Cadet Joined: Nov 18, 2003 Posts: 8 Location: USA

I am using a free AVG version.
Recently it always reports that a virus named 'tranjan horse backdoor.blarul' is found.
I have runned AVG but found nothing.
Can someone tell me how to get rid of it? Thanks!

CalamityJane · Posted: Tue Nov 18, 2003 10:55 am Post subject:

Hello mikegm Smile

Have you looked in the Virus Vault? It could be that the file was already quarantined by AVG.

Please open your AVG program and Choose *Program* at the top and then select *Virus Vault*. If you see any files in there you should be able to delete them with your AVG.

mikegm · Cadet Joined: Nov 18, 2003 Posts: 8 Location: USA

I have tried that, but still it jumps out some time.

TonyKlein · Posted: Tue Nov 18, 2003 11:46 am Post subject:

Where does it say the infected file is located?

CalamityJane · Posted: Tue Nov 18, 2003 12:03 pm Post subject:

Look under *Results* at the top of the AVG program and choose *test Results* For any scan listed in there where a virus was detected, please get the *detail info* . That will tell us where it was found Smile

You may find more than one. Start with the most recent first

mikegm · Cadet Joined: Nov 18, 2003 Posts: 8 Location: USA

it was first found in download files in directory 'edonkey', then I ran the AVG test and also uninstalled edonkey.
Today and yesterday AVG just jumped out to say this virus also found
in 'c:\system volume\'.

Bulldog · Posted: Tue Nov 18, 2003 12:58 pm Post subject:

You are running XP I presume.
The infection is *locked* in your system restore folders.
Please do this and then rescan with AVG.:
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

mikegm · Cadet Joined: Nov 18, 2003 Posts: 8 Location: USA

can's find the system restore tab in the properties.
also when I am trying to open the properties, jump out
"This application has failed to start because framedyn.dll was not found. Re-installing the application may fix this problem."
what shall I do now?
Sad

Thanks!

TonyKlein · Posted: Tue Nov 18, 2003 1:38 pm Post subject:

5260 ť Windows XP application failed to... Not Found

Also, how d'ya mean, no System Restore tab??

How many tabs do you see, and what are they called?

TonyKlein · Posted: Tue Nov 18, 2003 1:47 pm Post subject:

You could try this:

1. Insert the Windows XP CD
2. paste the following command in the RUN command box and hit enter.
rundll32.exe advpack.dll,LaunchINFSection C:\Windows\Inf\sr.inf

System Restore core files should be reinstalled.

Alternatively, open Windows Explorer, navigate to "C:\Windows\Inf" folder, right-click sr.inf and choose "Install" from the context menu.

Tell us how that goes.

Bulldog · Posted: Tue Nov 18, 2003 1:47 pm Post subject:

The system restore tab is missing because of this error you are receiving.
You need to check the path in Environmenatl variables.

To verify if this is the problem, try this.
Go to start > run > type command enter
At the prompt > that opens type ipconfig/all and hit enter
What happens ? Did you get an error or did it list your IP addys ?

Type exit to close the box.

mikegm · Cadet Joined: Nov 18, 2003 Posts: 8 Location: USA

I have searched "framedyn.dll", and have found the file in "c:\windows\system32\wbem",
also I have tried the method TonyKlein posted, but still no that Tab.
there are 6 tabs in my properties, no system restore tab

TonyKlein · Posted: Tue Nov 18, 2003 2:26 pm Post subject:

I wonder whether it's some kind of restriction. Will have a look.

mikegm · Cadet Joined: Nov 18, 2003 Posts: 8 Location: USA

no ip address lists,
and it says that ipconfig is not an external or internal command

Bulldog · Posted: Tue Nov 18, 2003 6:54 pm Post subject:


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 545 pages served in previous 5 minutes. Page Rendered: 0.465 seconds.