Posted 2-6-2009 9:28 (GMT +1) Quote: Backdoor Graybird--helpAlert an admin about: Backdoor Graybird--help
I just had this Trojan removed. I am using Symantec Antivirus. The AV keeps on prompting a detection on CUSTSATKEY.dll which detected as Backdoor.Graybird, however it was never sucessfully removed due to another SERVICE was installed and call the CUSTSAYKEY.dll
Here is what I did.
1) Launch Windows Explorer --> Tools --> Folder Options ---> Show hidden files and folders.
2) Browse C:\Program Files\Messenger
3) There are 5 hidden files:1) custsat.exe 2) CUSTSATKEY1.dll 3) CUSTSATKEY2.dll 4) CUSTSATKEY.dll 5) CUSTSATKEY.log
4) Download Autoruns from SYSINTERNAL (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx)
5) Launch Autoruns
6) Search for WudgSvc in Everything Tab
7) Right click to delete it.
8) Reboot
9) Remove all the 5 hidden files in C:\Program Files\Messenger
This is due to Symantec does not detect custsat.exe as a Trojan.
Don't install more than one Antivirus application at the same time. It is likely that they will conflict with each other and take a lot of resources in running together.
發表於 2010-1-2 18:15
樓主
