How-To Geek Forums Topic: external hard drive infected with Trojan.dropper and it can't be removed

How-To Geek Forums Topic: external hard drive infected with Trojan.dropper and it can't be removed http://www.howtogeek.com/forum/ How-To Geek Forums Topic: external hard drive infected with Trojan.dropper and it can't be removed en Thu, 08 Jan 2009 21:47:28 +0000 SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/3#post-42746 Fri, 15 Aug 2008 16:13:59 +0000 SarahJames 42746@http://www.howtogeek.com/forum/ <a href="http://s212.photobucket.com/albums/cc103/RareSarah/?action=view&current=2008-08-1518-10-13.png"><img src="http://i212.photobucket.com/albums/cc103/RareSarah/2008-08-1518-10-13.png"></a> SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/3#post-42745 Fri, 15 Aug 2008 16:13:04 +0000 SarahJames 42745@http://www.howtogeek.com/forum/ LOL - I'm not really sure what I did and if it is a problem or that it actually solved my problem. When I rightclicked G and selected Properties, at first I checked if there were new drivers. There were no new drivers. I also had the option to select to remove the drive, which I did andnow the whole drive G is gone, but H works all right (not sure what will happen after a reboot ...). When on H I can select to get G back, but I thought maybe this will enable me to leave H on and not having to worry the laptop get's infected. True? I'll leave the external drive disconnected, till I've heard from you:) Cheers, Sarah. SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/3#post-42738 Fri, 15 Aug 2008 15:59:21 +0000 SarahJames 42738@http://www.howtogeek.com/forum/ Hi Guys, Today I finally go round to formatting the external drive. So far it looks good. It is divided into two parts (I'm working on the laptop btw, not on my own computer). Drive H, which I formatted and it looks good. But there is also a drive G, which is called Password, about 15 MB in size and it acts like a CD. I tried formatting it in cmd, since in Computer> Beheren (Management?) there was no option to format. When in cmd I get this: <a href="http://s212.photobucket.com/albums/cc103/RareSarah/?action=view&current=2008-08-1517-54-31.png"><img src="http://i212.photobucket.com/albums/cc103/RareSarah/2008-08-1517-54-31.png"></a> In general: I need to add the name Password or it won't work to start with. And then it starts, but stops because 'the drive is writeprotected'. But AVG clearly indicates the virus is on this drive, I think it is vital I clean this thing up. Any suggestions? whs on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/3#post-41429 Sun, 10 Aug 2008 10:15:04 +0000 whs 41429@http://www.howtogeek.com/forum/ Sarah, maybe this helps. <a href="http://en.wikipedia.org/wiki/Live_CD" rel="nofollow">http://en.wikipedia.org/wiki/Live_CD</a> SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/3#post-41422 Sun, 10 Aug 2008 09:08:53 +0000 SarahJames 41422@http://www.howtogeek.com/forum/ Edit: now that my system is back to normal again I still have to take a look at that external HDD and remove the virus ... Knoppix is not my first choice as a means to get there (now wonder why that should be ...), so would it be safe to do it from the VistaPE bootCD? And how do I get the antivirus program on the bootCD up to date? Strong antivirusprotection seems a requirement here, don't you think? LOL That's one thing I don't understand about Live CD's - where do they write their data to? Not to the CD - that's impossible. To my HDD? But when I remove the bootCD I don't see a single trace of it and I've read topics that it is a good idea to start from a bootCD if you had a systemcrash and you want to save your data to USB / external drive etc. before doing a restore, because when you use the bootCD no data get's overwritten on your original system. So how does this work? (Ok not a need to know part of getting the virus off the external drive, I'm just being curious) Sarah. SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41418 Sun, 10 Aug 2008 08:44:45 +0000 SarahJames 41418@http://www.howtogeek.com/forum/ @ Dobermann - yes, I had removed the CD, LOL! And it was never a dual boot kind of thing. Just a Live CD to boot from. Normally removing the CD is enough to get back to your system without a problem and no files / entries are written to your normal bootsystem (Vista in my case). Offtopic - I used to have a Dobermann years ago. Lovely dogs and very photogenic (unlike my current black bunch ...) @ drifta - that's how I got in this morning > read on :) @ Lighthouse - F11 got me into the BIOS, but because of the wireless keyboard I have to be very, very, vééérrry fast otherwise it won't get acknowleged in time and I have to start all over again. My default startup was USB, CD, HDD. Looked ok, so I set to optimized defaults, because I didn't know what to change. That didn't help at all. So I set it to safety defaults. Didn't help either. Then I replaced the USB with my HDD and voila I got in in a breeze. I'll go back there next boot, because I want to try if it works CD first and then HDD. I had such trouble getting in this morning that I think it's the USB boot option that gives the problem. No idea as to why, but when I put in my VistaPE CD it also didn't boot and neither would the Knoppix CD. I guess it tries the USB device and when no boot item is found it stops there. I didn't have a look at the BIOS before all this, but my guess is the USB wasn't set as boot device when I got the PC and it somehow got changed, causing my trouble. But I shouldn't go all happy yet - can do that after my next boot and I know for sure things are back to normal again LOL. A very cheerful Sarah on a very windy and rainy sundaymorning;-D drifta on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41383 Sun, 10 Aug 2008 04:08:35 +0000 drifta 41383@http://www.howtogeek.com/forum/ @Sarah have u tried F2 to go into boot or F12 Dobermann on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41306 Sat, 09 Aug 2008 22:19:53 +0000 Dobermann 41306@http://www.howtogeek.com/forum/ Hi Sarah, I'm new here and was going to ask a question of my own, but then I saw this thread and since it sounded very interesting, I gave it a read. I am going to ask the obvious..... have you removed the Unix CD from the CD drive? Also, in Windows have you gone to Start | Right click on My Computer | Properties. Then select Advanced tab, within that Startup and Recovery Settings button. Click Edit to manually edit the start-up file options. From there, remove the references to the Unix OS system. For example, here is my startup file on XPP without dual boot: [boot loader] timeout=8 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn Notice how under the OS section there is only one listed. It's been years since I used a flavor of Unix, but as I remember, this is where it also logs the dual boot of your system. Have a look - and good luck! Now to post my own question..... Dobermann SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41188 Sat, 09 Aug 2008 17:54:15 +0000 SarahJames 41188@http://www.howtogeek.com/forum/ jack7h3r1pp3r - do you know about knoppix??? Are you here? SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41175 Sat, 09 Aug 2008 17:35:17 +0000 SarahJames 41175@http://www.howtogeek.com/forum/ Is there someone here with knowledge of Knoppix? I figure if I restart from the Knoppix BootCD maybe I might get into the BIOS. I remember pressing enter when I started the **** thing which allowed the system to boot from the CD, so the reverse should be possible too. But I couldn't find my way around Linux at all, so I'd like some advice of where to find what, before I get into rebooting again ... SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41171 Sat, 09 Aug 2008 17:32:24 +0000 SarahJames 41171@http://www.howtogeek.com/forum/ LOL - I'm already looking forward to my next boot .... So much so I didn't turn off the computer at all when walking the dogs today ... Lighthouse on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41168 Sat, 09 Aug 2008 17:30:08 +0000 Lighthouse 41168@http://www.howtogeek.com/forum/ I'm with you. But um? SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41159 Sat, 09 Aug 2008 17:21:11 +0000 SarahJames 41159@http://www.howtogeek.com/forum/ Tried everything I could think of and I'm clear out of ideas ... SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41158 Sat, 09 Aug 2008 17:20:37 +0000 SarahJames 41158@http://www.howtogeek.com/forum/ LOL - no I tried the past 5 or 6 times I have booted this thing! SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41157 Sat, 09 Aug 2008 17:20:00 +0000 SarahJames 41157@http://www.howtogeek.com/forum/ The only thing I get is a black screen with a white cursorline (can't remember the name .... LOL) and then I have to press ctrl + alt + delete and it restarts and then I've got to be fast and press F10. If I'm not fast enough I've got to do it again. When I'm fast enough I get a blue dos screen that gives me the options which drive to choose to boot from and then I'm ok, but it won't stick so next time I restart or start I have to do it all over again. Lighthouse on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41155 Sat, 09 Aug 2008 17:19:16 +0000 Lighthouse 41155@http://www.howtogeek.com/forum/ You must have a mega quick boot up sequence to have tried them that quick? SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41154 Sat, 09 Aug 2008 17:16:14 +0000 SarahJames 41154@http://www.howtogeek.com/forum/ tried that, but didn't work Lighthouse on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41152 Sat, 09 Aug 2008 17:15:51 +0000 Lighthouse 41152@http://www.howtogeek.com/forum/ Try "Esc" or maybe "Delete" SarahJames on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41150 Sat, 09 Aug 2008 17:13:38 +0000 SarahJames 41150@http://www.howtogeek.com/forum/ the only thing that works is F10 and then I can choose my c drive, but it won't stick. What other ways are there to get into the BIOS? Lighthouse on "external hard drive infected with Trojan.dropper and it can't be removed" http://www.howtogeek.com/forum/topic/external-hard-drive-infected-with-trojandropper-and-it-cant-be-removed/page/2#post-41145 Sat, 09 Aug 2008 17:03:59 +0000 Lighthouse 41145@http://www.howtogeek.com/forum/ Ah. So it won't let you in? Or you don't know how to get in on that particular machine?