Need Help With Nasty Trojan

Treat trojan

@Steve_R_Jones

Hello Steve,
I don't know if you still having trouble removing the Backdoor.Prorat trojan, but here is my experience with a company computer.
At first I tried to follow a few hints that were posted at this BBS. With no succes.
So I started thinking the ather way around: what causes te recreation of the winkey.dll, wininv.dll, fservice.exe and sservice.exe files?
Than I searched the files that were created for the last 24 hours.
At that point I found and unnowned directory in the systems 'Program Files' group. It was called "CARPE DIEM ", wich didn't ring a bell for me. It contained a singel coded file wich I didn't trust, so I just deleted the complete CAPE DIEM directory. After that I followed the treat from the symantec site again and it worked!
So if you still have the problem of the files to be made over and over again, try to find a unusual directory name. It mich help.

Greatings from William Geertsen

 

Fix for Prorat virus

Hi Steve

I was just wondering if you have found a fix for this nasty virus and I have got one if you want to try it. I saw this on another forum and it worked for me on my 98SE pc. here is part of the post

I found a fix for this lousy virus as I had it also and could'nt use my Nortorn Antivirus either. First you need to download the Prorat program itself. Next when you are unzipping the program you must enter a password as the program is password protected so enter pro as I had to find the correct password with trial and error. The program is over 3MB v1.8 I believe. Then you need to uninstall the LOCAL SERVER as there is an ICON at the top of the program, just hover your mouse over the icons to reveal local server entry. Then select the first button which will uninstall the LOCAL SERVER and that's it. Here is an excerpt of the post I found which will take you to the web site to download the program
"the best way to remove the prorat trojan is to download the actual program it's self http://prorat.net/downloads.php it then allows you to kill the local server, it removes all traces of the virus and then just make sure all you virus definitions are up to date.
It worked for me on my 98SE pc