Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations TouchToneTommy on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Error Message - Help..
- Thread starter Juleswc
- Start date
Searching with Google gives the description of this trojan TROJ_LEGMIR.BI
It modifies the following registry entry to ensure its automatic execution at every Windows logon:
From:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon
Shell = "Explorer.exe"
To:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon
Shell = "Explorer.exe C:\WINDOWS\System32\whboy.exe"
See the rest of the description here:
----------------------------------------
Everybody has the right to be stupid -- but some people abuse the privilege. (a quote from Stalin - and I am one of the abusers, sometimes...)
----------------------------------------
Experienced in the IT-chaos since 1984...
It modifies the following registry entry to ensure its automatic execution at every Windows logon:
From:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon
Shell = "Explorer.exe"
To:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\
CurrentVersion\Winlogon
Shell = "Explorer.exe C:\WINDOWS\System32\whboy.exe"
See the rest of the description here:
----------------------------------------
Everybody has the right to be stupid -- but some people abuse the privilege. (a quote from Stalin - and I am one of the abusers, sometimes...)
----------------------------------------
Experienced in the IT-chaos since 1984...
- Thread starter
- #3
- Thread starter
- #5
1. Go to Safe Mode
2. Start regedit, and navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Edit the value "Shell" so that it says only:
"Explorer.exe"
3. Delete three files:
\Winnt\bak.exe – this is a copy of the original Trojan.
\Winnt\System32\whboy.exe – this is a copy of the original Trojan.
\Winnt\System32\whboy.txt – this is a .DLL component of the Trojan that is used to run its malicious routines.
2. Start regedit, and navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Edit the value "Shell" so that it says only:
"Explorer.exe"
3. Delete three files:
\Winnt\bak.exe – this is a copy of the original Trojan.
\Winnt\System32\whboy.exe – this is a copy of the original Trojan.
\Winnt\System32\whboy.txt – this is a .DLL component of the Trojan that is used to run its malicious routines.
- Status
Similar threads
