Anyone familiar with the backdoor optix virus/trojan?

[Doggiedog]

I've been fighting this thing for the last few days but I can't get rid of it.

I've run 5 or 6 different AV programs in normal and safe mode but only AVG catches it. After it disinfects, the next time I reboot it's back again.

Besides fdisk or format, does anyone have any suggestions?

 

[minendo]

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optix.04.html

 

[Doggiedog]

Originally posted by: minendo
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optix.04.html

Believe me.

I've spent the last few days looking up ways to get rid of this thing but it always seems to come back.

I've tried

AVG
F-Prot
Panda
Norton
Symantec
Trend Micro
Kazerski (sp?)

and only AVG detects it and gets rid of it.

The only problem is it keeps coming back.

The instructions say to run in safe mode to remove it but AVG doesn't work in safe mode.

 

[minendo]

Originally posted by: Doggiedog

Originally posted by: minendo
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optix.04.html

Believe me.

I've spent the last few days looking up ways to get rid of this thing but it always seems to come back.

I've tried

AVG
F-Prot
Panda
Norton
Symantec
Trend Micro
Kazerski (sp?)

and only AVG detects it and gets rid of it.

The only problem is it keeps coming back.

The instructions say to run in safe mode to remove it but AVG doesn't work in safe mode.

Did you manually remove the registry keys created like was stated in the link I provided?

 

[Doggiedog]

I tried.

In fact, I printed out that exact webpage last night and took it home with me but I could not find those registry settings which is making this more frustrating.

On top of that, the other AV companies have different names for this thing. Before I found something called loonybot now its called backdoor optix.

 

[minendo]

Originally posted by: Doggiedog
I tried.

In fact, I printed out that exact webpage last night and took it home with me but I could not find those registry settings which is making this more frustrating.

On top of that, the other AV companies have different names for this thing. Before I found something called loonybot now its called backdoor optix.

Have you tried running adaware and spybot just in case?

 

[Aves]

I would try The Cleaner also.

 

[Schadenfroh]

run startup list from my spyware faq and post its log

 

[Doggiedog]

Adaware didn't catch it.

I'll try Spybot and Cleaner.

This thing is really tricky in that it disables most of the major AV and firewall programs out there.

 

[Doggiedog]

Sheesh.

Now this trojan came back as thorin.dropper.

WTH is happening?

 

[imported_Phil]

Install McAfee Internet Security, Norton Internet Security, Zonealarm, e-Trust Armor Suite, Windows firewall, Norton & McAfee Antivirus, Panda, AVG, Avast, F-Prot, Kasperski. All at the same time.

Let 'em loose.

 

[Doggiedog]

Originally posted by: DopeFiend
Install McAfee Internet Security, Norton Internet Security, Zonealarm, e-Trust Armor Suite, Windows firewall, Norton & McAfee Antivirus, Panda, AVG, Avast, F-Prot, Kasperski. All at the same time.

Let 'em loose.

Fortunately I have an Athlon 64 doing that as we speak. I was running at least 4 diff progs simultaneously but nothing worked.