Trojan trouble

Alright, I figure I will ask here though I also plan to ask my computer college professor.

A person who I do regular maintance for on his computer brought it back again. He runs WinXP Home.

Last time it was infected with more viruses trojans then I could count. So I set him and his family up on a limited user account. For about a week or so it worked just fine. Then BAM, he calls up one night to tell me the limited user account can't log in anymore. That puzzeled me, so I told him to bring it up next time we see each other, and in the mean time they can use the admin account to do whatever needs done.

So I gave him the admin password(no big deal.. pretty wimpy password), and he runs a scan and comes up with a trojan that from his description is the same one I dealt with when he last brought it to me. I had thought a-squared had killed it(took it more then a week to resurface which made me think that they had done something to reinstate it). I had him run a-squared on it amoung many other scanners. None of them can catch this little bugger. A-squared doesn't even seem to nail it anymore. Which is odd since it killed(or at least sent it to hiding) the last time.

Anyways the closest thing to an identification that we go on it is AVG calls it Trojan AHD. I think the full name AVG identified was Trojan.Dropper.agent.AHD or some such. I will have to wait till I get access to his comp to check the exact name. I have searched AVG's virus database to no avail and have checked a few others for a virus that sounds like what this does.

AVG does detect it but it can not remove it due to it existing in files and folders that don't exist. Last time I looked and looked to see where its hiding hole was and couldn't find the little bugger. I can't recall all the 'fake' files that avg says is infected but I do recall(and he also said it is popping up this time) a file named "wtf.exe". When searching the file I don't get a whole lot of aid(though I also haven't run in this vain for very long). But I haven't found anything on a virus/trojan that has AVG detect non-existant folders and non-exsistant files and that apparently blocks limited user accounts. Though I did find some interesting tidbits that I may try on his computer just in case.

My plan so far is to try and go through DOS after it. Perhaps a DOS based scanner can nullify it. It is getting to him. Because as I said last time it looked like it was the same stuff(though it fried the whole comp last time, so far the computer still 'works'), and it sure didn't take long for it to go back after the computer.

And I can say that it is bugging me. I can't kill it if I can't find it and neither can the different virus scanners.

I'd suggest checking for Spyware and also see what programs are running in Start-up. If it's the same thing thats come back i'd bets it's something thats come through p2p software like Kazza.

And if the PC was that infected in the first place i'd wipe out everything and re-install Windows, rather than trying to track down a single trogan.

i think ya just better off reinstalling windows XP mate....i keep my files and installion on seperate hard drives so i can reinstall often without fear oflosin files.....so just do that its ALOT easier

I would suggest reformatting the HD in this case :D It might be a rootkit that's causing the files to be hidden (extremely bad, worse than trojans), or the viruses/trojans are using a feature called Alternate Data Streams (ADSs) on the NTFS partitions - most virus and spyware scanners cannot scan ADSs, and of thos that can, they cannot clean them. The version of AVG I currently use can scan but not clean ADSs, I don't know if that's been changed more recently :p AVG finding stuff inside an ADS might also be why you think it's a non-existant file - ADSs are invisible even to Explorer :D

Aha! that makes sense. Would a ntfs dos boot disk see it? It certianally sounds like it could be the alternate data stream. Well I'll try it when I get home unless I get a negative on that.[edit- scratch this, I found that through dos I can access the ADS, if that is what it is. Will try that when I get the chance]

I would prefer to clean the computer without formating thier computer. If it was mine, I would have no qualms about a format(I back up my data). However, you average joe-bob user doesn't do so and I am trying to get used to fixing the computer without wiping it(since I do plan to at least do computer repair as a hobby).

The real problem of course, is preventing them from getting reinfected. I want to get my hands on the virus so I can play with it and try to find out how to block it. I got access to VMware so I don't need to worry about killing one of my own computers.

Alternate Data Streams, hmm... why haven't I heard of them, I have taken one college and am taking another now that already dealt alot with WinXP and the NTFS file system and this is the first time I recall hearing about it. Ah well, always something new to learn.

Edit-Thanks a ton for that Cl_out, perhaps now I can get ahold of the little fella :evilking:

Edit Edit- Those ADS can be nasty little blookes, though now that I know what they are and how to play with them it shouldn't be too tough unless it is a rootkit. then I gotta play some more(people really shouldn't let me around computers.. i think i go a bit nuts).

computers rule! :D anyway go to here to find some info on ADS' http://www.diamondcs.com.au/index.ph...d=ntfs-streams

and here for a tool for ADS deletion
http://www.codeproject.com/csharp/ntfsguiextension.asp

there you go! :D

here is another link from the computer incident advisory commitee (CIAC) http://www.ciac.org/ciac/bulletins/m-034.shtml

Well I managed to nail at least most of the trojans through DOS... and in actuality it was a different trojan.. a trojan.proxy.bcd or some such. attached with ADS to a system restore folder. Within the past couple weeks.. meaning they got nailed with it after I returned it to them last time.

However, the Limited user still won't work. And I am at a loss. Not that it matters much, I was going to format and put on FAT32 anyways. It appears the only infections that are giving them trouble are the ADS ones... and you can't infect FAT32 through ADS.