Win2000: Trojaner /Virus

Das hab ich gefunden dazu...

Have your taskbar and desktop icons disappeared?? At every boot, the desktop is empty ...
I noticed this little program box that just said "it's time" with the title "Project 1" and since it was late Friday and I was leaving in a minute I thought I'd track it down on Monday.
Big mistake!

This trojan/spyware/adware appears to be too new for AV and Spyware/Adware removers to find.
After scouring forums here is a list of steps, some or all may apply to your computer.

1) end the following process: sysu.exe, this is what causes the problems and seems to be an error in whoever wrote the program, kinda negates the purpose of it if nothing can be run by the user.

2) uninstall

Active Alert


3) delete the following folders:
C:\Programs\ddm
C:\Programs\pup
C:\Program Files\Internet Optimizer


in C:\...\system32\ look for .exe files that start with a random 7/12 digit number eg. 37473696.exe, check the properties to see if they were originally named winpup.exe and delete them

search for and delete the following:
actalert.exe
ddm.exe
ddm_d.exe
msbb.exe
optimize.exe
pup.exe
sysu.exe
winpup.exe


4) using Regedit (usual warning about backing up first)

delete these keys:
HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Run
and/or RunOnce that refers to ddm, *randomnumber*.exe or sysu.exe.

HKEY_CURRENT_USERS\SOFTWARE\ Microsoft\Windows\ShellNoRoam\MUICache
delete the keyfile C:\progra~1\ddm\sysu.exe

HKEY_CLASSES_ROOT\pup.setup


delete these folders:
HKEY CLASSES_ROOT\CLSID\{539AFCA0-9542-44F0-A286-9B8857DFD30A}

HKEY_CLASSES_ROOT\CLSID\{F5192746-22D6-41BD-9D2D-1E75D14FBD3C}

HKEY_CLASSES_ROOT\TypeLib\{2C4AC0A2-7DA0-4061-B57A-C292A8F3B109}

HKEY_LOCAL_MACHINE\SOFTWARE\Avenue Media

HKEY_LOCAL_MACHINE\SOFTWARE\\Dynamic Desktop Media

HKEY_LOCAL_MACHINE\SOFTWARE\ddm

HKEY_LOCAL_MACHINE\SOFTWARE\pup

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Shared Tools\MSConfig\startupreg\Internet Optimizer

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\App Management\ARPCache\Internet Optimizer

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Uninstall\Internet Optimizer

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Uninstall\Internet Optimizer Active Alert

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Uninstall\Internet Optimizer Software Installer

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Uninstall\msbb

HKEY_LOCAL_MACHINE\SOFTWARE\ Microsoft\Windows\CurrentVersion\Uninstall\nCase


5) using msconfig: uncheck the entry that corresponds to a file you deleted

6) open IE > Tools Menu > Internet Options > Settings > View Objects
locate the installed pesty little ddm and delete it.

Gruß

thx alot