RE: BACKDOOR.GRAYBIRD

[MARKO209]

Many Thanks - will try in morning - dont know where you are but 12.10 am
where I am - please send your details so I can keep in touch. Nice to know
that people are out there who can help - take care - MARKO 209

"Kah" wrote:

> I'll just relay the information I have found so far then:
> They are thinking it is a file in spysweeper and spyware doctor that Norton
> is seeing as a threat. Some have said they are contacting the software
> companies with this information.
> So I tried disabling Spyware Doctor from starting up with Windows and sure
> enough I did not get the virus alert until I manually opened it. Try
> disabling SpySweeper and reboot to see if you still get the threat alert.
>
> "MARKO209" wrote:
>
> > OK - Tried that but when I click on the IN Box - I get 2 options - Security
> > at Home Discussion Group or Security at Home News Group - I cant delete &
> > type in English
> >
> > "Kah" wrote:
> >
> > > Here on this site we are posting to. In the Search for put backdoor.graybird
> > > Then IN: English and hit Go button.
> > >
> > > "MARKO209" wrote:
> > >
> > > > Kah - search where - on the net or norton or my computer
> > > >
> > > > "MARKO209" wrote:
> > > >
> > > > > Running Norton Antivirus 2005 & Webroot Spysweeper. Nothing detected on
> > > > > either when system scanned but when booting/rebooting - message from norton
> > > > > antivirus saying virus detected & deleted. Have followed instructions from
> > > > > symantec to remove virus but cannot find registry items to be removed. Has my
> > > > > system been compromised and/or how can I stop this trojan from rebooting
> > > > > every time I switch on

[Kah]

Happy to be able to help. If anyone else was as stressed out about this as I
was (not being able to get rid of it)....Has made for an interesting day at
the least. Will post more if anyone finds more information.

[Kah]

[MARKO209]

COULD NOT RESIST - WORKED A TREAT - I WOULD BE GRATEFUL FOR FURTHER FEED BACK
- ESPECIALLY REGARDING WHAT THE SOFTWARE COMPANIES HAVE TO SAY - ANYWAY KEEP
IN TOUCH - THANKS AGAIN

[PA Bear]

Could be Backdoor.Graybird.O
(http://www.symantec.com/avcenter/venc/data/backdoor.graybird.o.html) or
Backdoor.Graybird.Q
(http://securityresponse.symantec.com/avcenter/venc/data/backdoor.graybird.q.html).

See the manual Removal instructions for each.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or http://aumha.net/viewforum.php?f=30
for expert analysis, not here.**

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE) & Security

[MARKO209]

MANY THANKS - KEEP ME POSTED AS TO HOW TO FIND & REMOVE THIS

"rivet" wrote:

> same situation as yours, norton antivirus 05 successfully identified and
> deleted this trojan but ran spysweeper, spy bot, and ms anti virus scans
> anyway plus a file search. nothing detected under graybird so threat appear
> neutralized, however, did detect a trojan or remants of a trojan called
> "backdoor.DKAngel" and am having a heck of a time deleting this file. it
> appears to have made/left an entry in the registry.