infected by r_server and iroffer.exe

Discussion in 'Computer Information' started by peter, Dec 27, 2003.

  1. peter

    peter Guest

    My computer is infected by r_server and iroffer, I can stop that process in
    task manager and find r_server and iroffer in registry and remove it, but
    when I restart my computer, these two trojan program restrart again, Is
    there any method to completely remove these two program? (Norton Antivirus
    can't detect these two program as virus)

    My PC OS is Chinese Windows 2000 (sp4)

    Thx a lot!
     
    peter, Dec 27, 2003
    #1
    1. Advertising

  2. peter

    hyenapower Guest

    Your computer is SCREWED! You better update Norton, I bet you don't have the
    new one. Wait, something fishy is here. How would one know which virus has
    infected their cmputer if their anti virus protection software suite in
    which they purchased would not protect the virus program? And no registry
    deletion aint gonna do poop.

    hyenapower
    who who who
    "peter" <> wrote in message
    news:bsj49o$...
    > My computer is infected by r_server and iroffer, I can stop that process

    in
    > task manager and find r_server and iroffer in registry and remove it, but
    > when I restart my computer, these two trojan program restrart again, Is
    > there any method to completely remove these two program? (Norton Antivirus
    > can't detect these two program as virus)
    >
    > My PC OS is Chinese Windows 2000 (sp4)
    >
    > Thx a lot!
    >
    >
     
    hyenapower, Dec 27, 2003
    #2
    1. Advertising

  3. peter

    Thor Guest

    Have you tried removing the registry entries while in safe mode? Clearly
    some viral or other process is running that is restoring the registry
    entries you removed, or there is an executable that is being called up at
    startup that is doing the same. Also, how do you know these are viruses when
    Norton is not picking them up? What has alerted you to a problem with these
    files? Could they be spyware? In which case you need a proper spyware
    remover program, not antivirus.

    ...
    "peter" <> wrote in message
    news:bsj49o$...
    > My computer is infected by r_server and iroffer, I can stop that process

    in
    > task manager and find r_server and iroffer in registry and remove it, but
    > when I restart my computer, these two trojan program restrart again, Is
    > there any method to completely remove these two program? (Norton Antivirus
    > can't detect these two program as virus)
    >
    > My PC OS is Chinese Windows 2000 (sp4)
    >
    > Thx a lot!
    >
    >
     
    Thor, Dec 27, 2003
    #3
  4. peter

    mbowen83 Guest

    I did a google search and this is what it turned up
    for iroffer
    http://fr.trendmicro-europe.com/enterprise/security_info/ve_detail.php?VName=BKDR_IROFFER.A
    (this link offers information on it as I did not have enough time to find
    detailed removal instructions)
    and for r_server (which is a remote admin tool for which you are on the
    controlled side) what you need to do is find the full path for the .exe file
    and then in the run dialogue box type the full path in quotes and use the
    /unregister switch (for example "c:\program files\whatever\r_server.exe"
    /unregister)
    then delete the file. Make sure you have system restore turned off though.

    mbowen83

    "peter" <> wrote in message
    news:bsj49o$...
    > My computer is infected by r_server and iroffer, I can stop that process

    in
    > task manager and find r_server and iroffer in registry and remove it, but
    > when I restart my computer, these two trojan program restrart again, Is
    > there any method to completely remove these two program? (Norton Antivirus
    > can't detect these two program as virus)
    >
    > My PC OS is Chinese Windows 2000 (sp4)
    >
    > Thx a lot!
    >
    >
     
    mbowen83, Dec 27, 2003
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Fatfreek

    WUPDTMGR.EXE infected says McAfee?

    Fatfreek, Nov 18, 2003, in forum: Computer Support
    Replies:
    3
    Views:
    505
    °Mike°
    Nov 18, 2003
  2. Me

    Backdoor.iroffer.1213.a

    Me, Dec 1, 2003, in forum: Computer Support
    Replies:
    13
    Views:
    931
    °Mike°
    Dec 3, 2003
  3. Gina & Keith

    infected PDH.EXE

    Gina & Keith, Jun 5, 2004, in forum: Computer Support
    Replies:
    4
    Views:
    1,074
    Boomer
    Jun 6, 2004
  4. peter

    infected by radmin and iroffer

    peter, Dec 28, 2003, in forum: Computer Security
    Replies:
    1
    Views:
    486
    Jim Watt
    Dec 28, 2003
  5. Doug Fox
    Replies:
    10
    Views:
    730
    donutbandit
    Feb 28, 2004
Loading...

Share This Page