Welcome to RCF - WHF

Bobby · Dec 31, 2004

Trojan Flooder

If you're like me, when you see the word "Trojan," you probably panic. Am I right? Of course, a Trojan is pretty much only associated with a virus (or at least some sort of threat) in today's computer world. They are basically completely destructive programs that disguise themselves as very helpful and useful programs. But, in all actuality, they contain hidden code which allows them to do harmful things to one's computer.

In the past month, a new Trojan has made its way onto the scene. It is called the Trojan Flooder.AKE and it has been found to mostly affect AVG users. There are a couple of symptoms with this that you can look out for. First of all, an alert box will pop up on your screen, telling you about a new threat found on your computer and that you should "heal it now." If you do that, your computer will restart, but that same message will still be there. Your computer will then be stuck in a loop of "flooding."

As I said earlier, this mainly only affects AVG users, so if you use AVG for your antivirus program, be on the look out for this. It may pop up on your screen at any time, so just ignore it and you should be just fine. Always stay safe!

rb2d2 · Sep 25, 2004

WOW! That's scary. How did you find out about it, Bobby? I haven't read anything anywhere, do you have a link?

Thank you for posting the warning, I think if I had gotten that message I would have said OK!

Shocked

rb2d2 · Sep 25, 2004

This does not sound good ...... Bottom line may be to reload your operating system?!

http://answers.yahoo.com/question/index?qid=20061212061655AAi1goP

This is two weeks old, it's been around at least that long and I have not read anything about it?!

Shocked

rb2d2 · Sep 25, 2004

May be useful to bookmark this place:

http://www.econsultant.com/spyware-database/how-to-remove-flooder.html

Applause

rb2d2 · Sep 25, 2004

More info here. Am I to understand that AVG actually causes this disaster? Or IS it a disaster? I'm left a bit confused by this site.

Says it's a bug in AVG and all you need to do is uninstall and re install AVG but then it goes on telling about all the damage it can cause. What the heck is going on anyway. As an AVG user why haven't I gotten an email from AVG telling about this .... this ... whatever it is??

violent1

Bobby · Dec 31, 2004

I got this information in a WorldStart Computer Tips newsletter that I recieve in my e-mails daily.

Bobby · Dec 31, 2004

Here is a further discussion on CNet Tips about the Flooder.AKE Trojan.

http://forums.cnet.com/5208-6132_102-0.html?forumID=32&threadID=221914 &messageID=2340025

rb2d2 · Sep 25, 2004

Thanks, Bobby. I'm really gratful this didn't happen to me! What a mess.

Crying or Very sad

Bobby · Dec 31, 2004

Source; WS Computer Tips Weekly.

Additional information.

Q:
Now that you've told us about the Trojan Flooder threat, is there any way to fix it?

A:
There sure is and I'm glad you asked. It was only yesterday that I shared the news with all of you about the Trojan Flooder.AKE risk (see yesterday's quick tip) and already, several of you have e-mailed me, asking me how you can fix it. I had planned on following up with this information, but now I know there is a great need for it, so I won't waste any more time!

Before I begin with that, I just want to fill in anyone else who has not heard about this yet. You can certainly go back and read yesterday's quick tip for the whole scoop, but just briefly, the Trojan Flooder is a threat that is affecting a lot of the AVG antivirus users. They are being tricked into "healing" their computer for the good, but are ending up with a harmful exploit on their computer instead.

If you are an AVG user and have come in contact with this Trojan, it is extremely important to fix it right away. So, here are a couple of suggestions that I was able to find for this. Hopefully, at least one of them will work for you.

1.) First, boot your computer in the Safe Mode form. To do this, turn your computer off and then restart it while pressing the F8 key continuously until the Safe Mode startup menu appears. From there, choose Windows in Safe Mode.

Next, you're going to uninstall your AVG service. Go to Start, Control Panel, Add/Remove Programs. Find its applet and click the Remove button. When that's done, restart your computer and then reinstall the AVG program and do an immediate update on it. That should take care of the Trojan and all of its components. If not, try the second suggestion below.

2.) Again, boot up your computer in the Safe Mode form. (Follow the same directions listed above to do this). Once there, choose Windows in Safe Mode.

From there, go and find the folder of C:\WINDOWS\system32\drivers\. (Double click on the My Computer icon on your desktop, double click the C: drive and continue from there). Next, you'll need to find a couple of files. Change them as follows:

Change AVGCLEAN.SYS to AVGCLEAN.SY_ and change AVGRSXP.SYS to AVGRSXP.SY_. This will help keep the winlogon.exe file in place like it should be.

Now, the next part involves using the Registry Editor. There is always a risk with working in the Registry. If you make a mistake, it could alter other parts of your computer, so if you're not 100 percent sure you know what you're doing, please find someone who does. It's very important!

When you're ready, go to Start, Run, type in "regedit" and click OK. Once there, find the registry key of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvgClean. Now, go and remove the "__delete" value from the right window pane. Then restart your computer back in the normal Windows mode.

You should also make sure you update your AVG service to fulfill the latest virus base version. To do that, open the AVG program or the AVG Control Center. Then press F9 to get the current updates. Once you're all set with that, you have to go back and rename the same files you changed earlier. Find the C:\WINDOWS\system32\drivers\ folder again and change the following files.

Change AVGCLEAN.SY_ back to AVGCLEAN.SYS and change AVGRSXP.SY_ back to AVGRSXP.SYS.

Once you have that done, you need to restart your computer again and then just make sure the AVG Resident shield loads again. This will keep you the safest. Well, there you go. Hopefully one of those suggestions will work for you and you can be rid of the Trojan Flooder for good. You can't beat that!

rb2d2 · Sep 25, 2004

Thanks for the update, Bobby. Yesterday my son started telling me about the Trojan they got at work .... I was thinking OH NO! ...

He said the message appreared on the screen and the boss lady called him in to deal with it. He clicked ok to have it cleaned and then attempted to reboot, a box popped up downloading something, he Xed it out and before he could reboot it popped back up, he Xed it out again, tried to reboot, the reboot box opened but he said he could see another box behind it, he moved the reboot box over and it was that same box trying to download something and it was almost at 90 percent. He once more Xed it out and finally was able to reboot. The machine rebooted just fine, no looping, he updated AVG, did a scan and AVG ran without finding anything. So I guess he beat it at it's game.

He was lucky!

Shocked