Comments on: Trojan.Blusod http://www.precisesecurity.com/trojan/trojanblusod Thu, 24 May 2012 12:56:45 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Evehttp://www.precisesecurity.com/trojan/trojanblusod#comment-1701 Eve Sun, 28 Sep 2008 17:00:51 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1701 I am also a victim of this worm. What random numbers go in here? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ”lph[RANDOM CHARACTERS]” = “%System%\lph[RANDOM CHARACTERS].exe”This was where the virus was and I deleted it. System restore looks like it worked but the restore fails.Thanks, Eve I am also a victim of this worm. What random numbers go in here? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
”lph[RANDOM CHARACTERS]” = “%System%\lph[RANDOM CHARACTERS].exe”

This was where the virus was and I deleted it. System restore looks like it worked but the restore fails.

Thanks,
Eve

]]> By: Techuserhttp://www.precisesecurity.com/trojan/trojanblusod#comment-1679 Techuser Thu, 18 Sep 2008 21:54:05 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1679 Yes, your wallpaper changing ability is probably disabled in the registry.Click "Start" then "Run" type in "regedit" and hit enter.Then browse to the following key.[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]You can click any of the following keys (that appear in your list), then just hit the delete key on your keyboard."NoChangingWallPaper" "NoAddingComponents" "NoComponents" "NoDeletingComponents" "NoEditingComponents" "NoCloseDragDropBands" "NoMovingBands" "NoHTMLWallPaper"=Then restart your computer. Yes, your wallpaper changing ability is probably disabled in the registry.Click “Start” then “Run” type in “regedit” and hit enter.

Then browse to the following key.

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]

You can click any of the following keys (that appear in your list), then just hit the delete key on your keyboard.

“NoChangingWallPaper”
“NoAddingComponents”
“NoComponents”
“NoDeletingComponents”
“NoEditingComponents”
“NoCloseDragDropBands”
“NoMovingBands”
“NoHTMLWallPaper”=

Then restart your computer.

]]> By: Dawnhttp://www.precisesecurity.com/trojan/trojanblusod#comment-1676 Dawn Thu, 18 Sep 2008 02:11:30 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1676 If that doesn't work - try this: Go to Start>Run, type in gpedit.msc and hit enter. Under Computer Configuration, click on the + next to Administrative Templates, click on the + next to System, then click on the System Restore folder. In the right-hand pane, double-click on Turn off Configuration and under the Setting tab click in the radio button beside Not Configured. Click on Apply then OK. Then go back and do above to make sure the service is started. If that doesn’t work – try this:
Go to Start>Run, type in gpedit.msc and hit enter. Under Computer
Configuration, click on the + next to Administrative Templates, click on the + next to System, then click on the System Restore folder. In the right-hand pane, double-click on Turn off Configuration and under the Setting tab click in the radio button beside Not Configured. Click on Apply then OK. Then go back and do above to make sure the service is started.

]]> By: Dawnhttp://www.precisesecurity.com/trojan/trojanblusod#comment-1675 Dawn Thu, 18 Sep 2008 02:01:35 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1675 Right click on My Computer icon, left click on Manage, then click the + on Services and Applications, and click on Services, and scroll down to System Restore Services and verify that it is set to Automatic. To do this - right click on System Restore Services, then left click on properties - the start up type should be automatic. After you set that to automatic - right click on System Restore Services again and make sure stop is the option which would mean the service is started. Right click on My Computer icon, left click on Manage, then click the + on Services and Applications, and click on Services, and scroll down to System Restore Services and verify that it is set to Automatic. To do this – right click on System Restore Services, then left click on properties – the start up type should be automatic. After you set that to automatic – right click on System Restore Services again and make sure stop is the option which would mean the service is started.

]]> By: Vikentihttp://www.precisesecurity.com/trojan/trojanblusod#comment-1671 Vikenti Tue, 16 Sep 2008 03:03:14 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1671 Hi, I had the same problem as Rhys and John, I thought I completely fixed my registry but system restore still refused to work (in my case, Norton refused to recognize C:\ drive for defragmenting and windows defragmenter didn't work eithere). So I did what was suggested and installed and used MalwareBytes and it fixed all my problems, registry is fixed, system restore is working perfectly and Norton and Windows defrag properly again. Thanks a bunch Dawn. Hi, I had the same problem as Rhys and John, I thought I completely fixed my registry but system restore still refused to work (in my case, Norton refused to recognize C:\ drive for defragmenting and windows defragmenter didn’t work eithere). So I did what was suggested and installed and used MalwareBytes and it fixed all my problems, registry is fixed, system restore is working perfectly and Norton and Windows defrag properly again. Thanks a bunch Dawn.

]]> By: xoxohttp://www.precisesecurity.com/trojan/trojanblusod#comment-1669 xoxo Mon, 15 Sep 2008 20:59:21 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1669 Hi, Malwarebytes I believe removed or cleaned the Trojan from my computer. However, I still do not have the ability to restore to a previous date for my system restore. Does that mean it is still infected? Hi, Malwarebytes I believe removed or cleaned the Trojan from my computer. However, I still do not have the ability to restore to a previous date for my system restore. Does that mean it is still infected?

]]> By: Rhys Framptonhttp://www.precisesecurity.com/trojan/trojanblusod#comment-1657 Rhys Frampton Sat, 13 Sep 2008 14:13:03 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1657 HI Guys. And thank you for the tip on Malware. I does seem to work and get rid of the virus etc, with the least amount of effort. But I too have the same problem as John. I too am unable to re-instate my System Restore.. It say system restore (Disabled by Group policy) I will keep searching and let you know if I find anything.Cheers HI Guys. And thank you for the tip on Malware. I does seem to work and get rid of the virus etc, with the least amount of effort. But I too have the same problem as John. I too am unable to re-instate my System Restore.. It say system restore (Disabled by Group policy) I will keep searching and let you know if I find anything.

Cheers

]]> By: John Sivertsenhttp://www.precisesecurity.com/trojan/trojanblusod#comment-1644 John Sivertsen Tue, 09 Sep 2008 01:14:42 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1644 I followed all of the instructions and have the system back to normal. Except, I cannot get System Restore to start up again. Is there something obvious that I should do? (Under "Properties" at My Computer the box for "Turn Off System Restore" is and remains unchecked).Looking at the very first question by Bob Haig about the Software Notifier "Installation ID". Can you explain exactly what I should be doing there? Do I (a) type in the value ("906..etc.), (b) do I delete this value, or (c) do I delete all of the "Installation ID" entry. This is the one instruction that I wonder whethere I am just not clear on. I followed all of the instructions and have the system back to normal. Except, I cannot get System Restore to start up again. Is there something obvious that I should do? (Under “Properties” at My Computer the box for “Turn Off System Restore” is and remains unchecked).

Looking at the very first question by Bob Haig about the Software Notifier “Installation ID”. Can you explain exactly what I should be doing there? Do I (a) type in the value (“906..etc.), (b) do I delete this value, or (c) do I delete all of the “Installation ID” entry. This is the one instruction that I wonder whethere I am just not clear on.

]]> By: Lorihttp://www.precisesecurity.com/trojan/trojanblusod#comment-1642 Lori Mon, 08 Sep 2008 16:58:41 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1642 MalwareBytes is the ONLY thing that I've found that works with this. I would recommend downloading, install, update and then boot in safe mode and run the scan. It will restore your registry with default values so you don't have to guess what your original values were. MalwareBytes is the ONLY thing that I’ve found that works with this. I would recommend downloading, install, update and then boot in safe mode and run the scan. It will restore your registry with default values so you don’t have to guess what your original values were.

]]> By: Lorihttp://www.precisesecurity.com/trojan/trojanblusod#comment-1635 Lori Sat, 06 Sep 2008 02:12:57 +0000 http://www.precisesecurity.com/threats/trojanblusod/#comment-1635 Got the virus with Norton installed, updated and running. Says it blocked it and removed it but now my background and screen saver are gone. Sugumar with Norton told me to contact Dell...or I could pay Norton $99 to fix my PC for me.I love tech support from Pakistan! Got the virus with Norton installed, updated and running. Says it blocked it and removed it but now my background and screen saver are gone. Sugumar with Norton told me to contact Dell…or I could pay Norton $99 to fix my PC for me.

I love tech support from Pakistan!

]]>