April 10, 2008

How to remove Trojan.Drondog ?

Trojan.Drondog Removal tips.

1. Replace corrupted ‘userinit.exe’ through Recovery console in Windows

To remove this threat it is necessary to restart the computer and run the Windows Recovery Console. For full details on how to do this please read the Microsoft Knowledge Base article, How to install and use the Recovery Console in Windows XP.

1. Place Windows XP CD-ROM into the CD-ROM drive.
2. Restart the computer from the CD-ROM drive.
3. Press R to start the Recovery Console when the "Welcome to Setup" screen appears.
4. Select the installation that you want to access from the Recovery Console.
5. Enter the administrator password and press Enter.
6. Type cd I386.
7. Press Enter.
8. Type copy USERINIT.EX_ C:\windows\system32\userinit.exe
9. Press Enter.
10. Type exit
11. Press Enter. The computer will now restart automatically.

2. Disable System Restore (Windows Me/XP)

If you are using Windows XP or Windows ME, You must disable or turn off System Restore before Virus scan because the _Restore folder is protected by default. Antivirus cannot remove virus or any malicious files inside _Restore folder. Windows prevents outside programs,including antivirus programs, from modifying System Restore. The System Restore feature is not designed to detect or scan for virus infections or virus activity.

How to disable System Restore ?

3. Update computer anti virus software with latest virus definitions.

Almost all anti virus software have an latest virus definition update feature. Latest Virus definition contains details of information related to latest virus.

4. Backup system registry.

You must backup System registry before editing the registry because it contains information and settings for all the hardware, operating system software, most non-operating system software, users, preferences of the PC, etc. Any wrong changes will lead you to more problems.

How to backup Windows Registry ?

5. Restart your system in safe-mode.

An operating system in safe mode will have reduced functionality, but the task of isolating problems is easier because many non-core components are disabled (turned off). An installation that will only boot into its safe mode typically has a major problem, such as disk corruption or the installation of poorly configured software that prevents the operating system from successfully booting into its normal operating mode.

How to start your system in safe-mode ?

6. Run a full system virus scan using your updated anti virus program.

Source: Symantec

No comments: