bug program file that is not removeable!

My brother downloded a file off of morpheus. Called killpokemon.exe it was in software! Now I cant remove it I cant even acess it. On my firewall it shows that someone on the outside has been getting into my system and a few times has actually changed everything which is alot of work to fix. What i need to know is there any way to remove this? When i try to acess it it say denied....When I delete it the progrm moves into another file! It is impossble to get into or get out! Any help would be appreciated!!!!!!!!!!!!!
e-mail me at [email protected] if you think you can help! Thanxs

If you have Win95-ME. Use a boot disk. If you don't have one get one here.
http://www.bootdisk.com
Then boot with the disk to a DOS prompt. Use the "CD" command to navigate to the directory it's in and delete it. Then reboot.

Also get a good antivirua and run it from boot. Such as norton's. I can be run from the CD at boot to clean an already inffected system. As well, get you a good trojan removal and scanner progy. Such as The Cleaner ( http://www.moosoft.com ) or T Fak ( http://www.kryptocrew.de/snakebyte/tfak.html). You also should restrict the useage and access to the puter. Go to Web Attack ( http://www.webattack.com ) they have a large security section of freeware that will help you.
Hope this helps.

Sounds like you have been infected with a trojan try going to blackcode and using their trojan scanner.....if it comes up with a certain trojan do a search on google for a wy off removing it

hope that helps :)

v_Ln

Mellissa, ...this is what you do.

I've run into this problem a few times...and I know. It sucks. All you have to do is go to the 'software' section in your Morpheus. Then click on a program that you really don't need, that is not killpokemon.exe. Now:

Press 'Ctrl' and click on "killpokemon.exe" - It should highlight...now without moving your mouse. Hit 'Delete' up near the right center of your keyboard (in that place with only six buttons above the arrow keys). It should delete the two programs.

Now, goto: McAfee or Symantec and download one of their free AntiViralKits. OR, just scan your computer for free, and make sure to select the option for them to clean it while their scanning.

After that you just watch yourself, and every program you download, ...scan with an AV (AntiViral) program.

Thanx's for all the input...I do have the anti-virus and run it reg....I even ran the file through it and no virus there. I looked at the codes in the quick view. it's the only way into the file at all. I think there must be a code to enter the program when it says that acess is denied. This is what i hope to find. I want to get into it and sever the concetion that way. Is this possible?

You said you have run the antivirus regularalyu, but it picks up nothing? This must mean this particular virus infects your AVKit itself...or you have another virus that malfunctioned your AVKit. And what 'codes' did you look over? You say there's a code to enter the program...is it password protected? The 'access denied' is probably just a cover up window for infecting you, so you beleive that nothing serious has gone wrong. I would highly reccomend you do an online virus scan. Just to make sure. If my advice up top hasn't worked...move everything out of your shared folder and then delete the folder,...then just create anotherone with the same name, and place everything back in.

139 netbios-ssn OPENE ....when I went to the scan site that is the port that it said was open. How do I close it? I took everything out of the file and removed it and so on....no luck the little bugger popped up again in another place! I have saved it to disk so I can try to get in. I cant even do the double program delete that was mentioned above. It says denied acess! Can I crack into the file somehow? Is there a way in? I really dont want to delete the whole computer and re-boot my system. Can it be avoided? Thank you for takeing the time to help me out.

The code i spoke of were of the file itself. In the quick view I saw the characteristics of the file(killpokemon) and it was mostly 0000 with a few letters and #

for the time being, download a firewall, diconnect from the net (don't dial in/take out the cable), set it to prompt/block stuff, and reconnect. You should be able to block his acess to it, if you can't delete the trojan itself.

Welcome to Antionline Mellissa,

The above people have given you good advice :D

I have downloaded a trojan removal sofware and it says I am free and clear of trojans. I also went to nortan and they did a compleate sweep and there was nothing. From what I have been able to find out this file is a "spyware"? It is all over the KaZaA site as well as morpheus. What are the differences in the 2? (trojan vs spyware) I Thank everyone who has awnsered my posts. Your info is invaluable to me and I really apreciate it all. The one thing this has taught me is I need to know more about the internal workings of the computer.
Off I go to put the firewall I have in. :)

Try scanning with Ad-aware if you think it's spyware.
http://download.cnet.com/downloads/0...108-63806.html

What OS are you running?

There is not really much of a difference between trojan or spyware, well technically there is some things I think that may be different, but all that either one will do, trojan or spyware is, allow someone to theoretically, sit down at your computer and do whatever they want, and look over your shoulder and see everything you do when you are at you computer.

Quote:

---

Originally posted here by 3ntropy
There is not really much of a difference between trojan or spyware, well technically there is some things I think that may be different, but all that either one will do, trojan or spyware is, allow someone to theoretically, sit down at your computer and do whatever they want, and look over your shoulder and see everything you do when you are at you computer.

---

A Trojan is usually a malicious program that let's someone control your computer from a remote location (i.e. the Internet). Spyware are programs (which DO fit the definition of Trojans) that monitor your websurfing habits and then send the info off to a 3rd party, usually a company or marketing firm. Adaware (see other posts) is the proper tool used to get rid of these little s**** :mad:

:3pow: Spyware :3pow: Trojans

do as they told ya for the boot disk and then install the cleaner .. that might help
u can also try lots of torjan cleaners from the blackcode.com

Update guys,
I spent some time with Mellissa on MSN Messenger this morning. She sent me the file in question and I analyzed it. It's BackDoor-Z aka BladeRunner Trojan. I'm having a HARD time helping her get rid of this little bugger as it's running form multiple locations. I know someone here can give me a hand.

:3pow: Trojans and Script kiddies

Quote:

---

Originally posted here by shkuey
Try scanning with Ad-aware if you think it's spyware.
http://download.cnet.com/downloads/0...108-63806.html

What OS are you running?

---

AdAware is nice, but it only detects a few types of spyware. You can, however, edit the list that it scans for (I think, I wasn't able to test it properly)

Update 2
In addition to finding BladeRunner she also downloaded AdAware whick fouund 35 pieces of spyware!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Last night i engaged my lock on my firewall....no in or out activity. Damned if not five mins later everything was changed on my desktop and then it just shut down on it's own. I am re-formating tommorow and taking more care. Thanks to all who helped!

"Complete lock" didn't stop a connection? I think I've lost faith in ZoneAlarm...

It may not be the firewall's fault if it was
installed after the computer was already
infected, or if the trojan was ,through
some mis-configuration, authorized to
operate.
Some considerable knowledge is required
to really "secure" your machine, and obviously
the wisest first step in this case is the fresh
install of the OS
:cool:

Update! I am getting someone to re-format this week end. my question is ....What is the better firewall? Black ice defender, Norton, Or the Panda. What else is recomended to make the security top notch on my computer? What is the best cleaner and scanner? I have ad-aware....and bo-detect. All of these I got AFTER I was infected. Now I want to make the most of what I can! Also on the norton firewall there is a little blinking spot with a red top. Is this sopposed to be there? Thankxs all.

just boot into dos, if u know what file it is. delete it. also open up ur win.ini and system.ini with edit.com to check for any "bad" things. lol i was to tired to read all the above posts, so if this has already been said, then sorry :)

just boot into dos, if u know what file it is. delete it. also open up ur win.ini and system.ini with edit.com to check for any "bad" things. lol i was to tired to read all the above posts, so if this has already been said, then sorry :)

[

Quote:

---

Originally posted here by mellissa
Last night i engaged my lock on my firewall....no in or out activity. Damned if not five mins later everything was changed on my desktop and then it just shut down on it's own. I am re-formating tommorow and taking more care. Thanks to all who helped!

---

QUOTE] Originally posted here by mellissa
Update! I am getting someone to re-format this week end. my question is ....What is the better firewall? Black ice defender, Norton, Or the Panda. What else is recomended to make the security top notch on my computer? What is the best cleaner and scanner? I have ad-aware....and bo-detect. All of these I got AFTER I was infected. Now I want to make the most of what I can! Also on the norton firewall there is a little blinking spot with a red top. Is this sopposed to be there? Thanks all. [/QUOTE]

WTF....BladeRunner still got though AFTER you said NO AND IT GOT THROUGH THE LOCK. I DON'T BELIEVE THIS :eek: :mad:. I USED to be a big believer in ZoneAlarm...in fact I was just about to purchase 3 copies of ZoneAlarm Pro for my 3 boxes....not now :(. At this pont I say a wipe clean is the best option. I was reluctant to go that way earlier Lissa because of the data loss involved in the process...but now it's the best (and only way)...I feel really bad about this Lissa :(...come on MSN Messenger again when you get setteled .

Matt

Bug program file that can't be removed = windows.exe
;)

SSJVegeta-Sei

Quote:

---

Originally posted here by NullXero
just boot into dos, if u know what file it is. delete it. also open up ur win.ini and system.ini with edit.com to check for any "bad" things. lol i was to tired to read all the above posts, so if this has already been said, then sorry :)

---

I spent about three hours with Mellissa on MSN Messenger the other day....had her check ALL the stuff: Win.ini,System.ini and the Registry. We found the BladeRunner Registry Entry and I had her remove it....but it came back upon boot up....so we checked the other 2 files then. I even had her check to see if there was a lot of spaces on a line (i.e. run= Trojan.exe). I didn't have BladeRunner removal info handy so I had Mellissa download ZoneAlarm to hold her over untill I could find more detailed info than what I had at the time from the Panda Software site....I did find it and BladeRunner has a quirk where you have to delete the server file first in DOS before you can remove the Registry Key but something happened with ZoneAlarm and BladeRunner got though even though she said NO to the Trojan file...It even got through the Internet lock when she locked it....don't ask me how it happened :( :mad:

:3pow: Trojans :3pow: Script Kiddies :3pow: ZoneAlarm

Mellissa, perhaps the moral of this is that your brother needs something better to do than downloading files like "killpokemon.exe" from Morpheous. Not to say that I have a better life, but I try not to drag everyone down with me. In general, I wouldn't trust any executable file from a P2P program unless I had run a scan on it at least once, and was sure of its trustworthiness anyhow.

SSJVegeta-Sei

He really thought it was going to be porn. The title was pussymovie.veryfunny. The kill pokemon didnt show up till later :0 Now he is not allowed to download porn.

mellissa - it sounds like you have got it worked out, albeit the hard way. In addition to what the others suggested, you may wish to try PestPatrol, it finds much spyware etc.

good luck.

A good firewall should close and/or stealth NetBIOS 139...then the only problem left is sanitizing your comp...if you run a Windows OS, it may take some work, but just research it...it's logged in the registry. Try a program called RegVac found on www.cnet.com, the software scan should recognize it as a suspect program, and ask you to delete its associations with everything...do that.

Ouroboros

Most likely the reason ZoneAlarm didn't catch the open port BladeRunner was using is that it had already established it's connection prior to the install of the firewall. AFAIK, the firewall should have been installed and configured -prior- to the actual online connectivity. Then the blocking should have worked.

Just out of curiousity, what type of connection are we talking about here? DSL? Cable? *shudder* Dial-up? If it's DSL/Cable, I would not only suggest one of the many firewalls out there, but also a router using NAT via DHCP in / DHCP out. It's not fool proof, and will not substitute for an actual firewall, but it -is- an added layer of protection.

If I can find it, I have some detailed instructions on removal of BladeRunner that may be of assistance. If I can find them, I'll post them.

Joining in a little late,
-Aryoche

Here are some links I found that may be usefull..

http://www.bsoft.swinternet.co.uk/tr...ade_runner.htm

http://www.dark-e.com/archive/trojans/blade/index.shtml

I hope that helps.

Howdy yall, the only reason I am on this fourm is because of this thread. A win98 customer called MS support (Me) last night because he was getting an error with kill pokemon at boot "execption e-socket in module killpokemon.exe" this had broken IE and outlook express.
I did some searching on the internet on killpokemon.exe and edventually after trying a few search engines came up with this thread.

Ratman2 gave me the info I needed I did a search for the bladerunner trogan on www.norton.com and removed the system-tray entry form the run key however the trogan just recreated it.

What edventually solved the issue for us was to boot to MS-DOS and then delete killpokemon.exe (it was in a kazaa folder) then power off the computer to clear the memory then boot into windows and remove the system-tray entry from the run key in the reg. This was a new improved version of the bladerunner trogan. I stayed 2 hours over the end of my shift removeing it just because I love fighting viruses and now trogans and winning :)

FYI and thanks Ratman2

I ran in to a few of these things before and somtimes the thing can be well hidden. One thing to try is use regedit and see if you can spot anything thats loading that shouldnt be or does not need to be under hkey local machine/software/microsoft/windows/current version/run and anything else with run ie..runonce...runservicesonce here you might find what is loading. I would also run sysedit and take a look at the autoexec.bat and config.sys files then look at the load= line in the win.ini
I would be surprised if the was a link in the startup folder but its worth a look.

another route is to use a prog to give you a list of all proccesses running you could try sysinternals.com there is a prog there called process explorer also I run a windowed netstat prog to monitor connections using tcpview.exe from the same site. with these two you should be able to track down the "pirate bastard file" :)

Hope this adds to the information you asked for!