How to remove variant of WIN32/Obfuscated trojan in Win2000?

July 17th, 2008 · No Comments

AVG and Kaspersky could not find it existed. It popup automatically an explorer to link to a certain website within a certain time. I scan Win2000 with NOD32. It said the file under \winnt\system32\efcBqpOE.dll was infected. This dll cannot be removed,delette because it said it was used by window at that time. I restarted in safe mode and scan with NOD32. This time NOD32 said it can be deletted,rename or isolated. After a reboot,error message was still existed. That means NOD32 could not fix it even it said DONE! I try to replace this infected dll but it was not existed in the Win2000 CD. How to remove it ? I knew format the disk is the last solution,however any smart way to delette it.
I can delette manually this dll after it was renamed by NOD32
but not the one has the proper name.
NOD32 warning message when scanning:
"System memory infection originated from file C:\winnt\system32\efcBqpOE.dll
efcBqpOE.dll infacts is a trojan hacker's software that placed inside Win32.
I compared with a healthy win2000 computer,its system32 did not contain the file called efcBqpOE.dll
Therefore,this dll should not require for win2000 and it was a hacker's trojan.
I use dos mode under win2000 to delette it but it refused to excute. It said file is used for other program. A dos win98 bootup disk is not good to access win2000 file under pure dos mode. And Win2000 did not provide any bootup disk in dos during installation process. Any bootup software in dos mode existed nowaday that is able to access win2000 files or xp files under dos instruction?
I think this is the only way to remove the hacker's file.
hacker's dll hides in the memory as win2000 is bootup and windows prevents this dll to be removed (file cannot be removed,changed or deletted when it is running).