No Crash Logo
Simple install, no plumbing Solar Hot Water! Save $$$   Click Here

 Removing the trojan lastad or furj in XP home Post a Reply  
From: Frank on 06/12/2005
If you are getting popups you may have a trojan called "lastad", it's spamware / spyware.

Adaware does not detect this, but the program "antivir" (free) detected it and tells you where the "DLL" file is.

However, at startup this DLL will get re-loaded because there's a program called "furj" that runs at startup.

Here's what I did. If you are a complete idiot, don't try this, it's not fool proof.

Start the computer but keep pressing "F8" key over and over till you get to the safemode screen and start up in safemode.

Now use Start->Programs->Accessories->Windows Explorer (I don't know why they buried it like that but's it's a great little thing).

Now go to your C: drive, then Windows->System32

And in the "tools" pull down menu go to folder options and click on the "show hidden files" so you can see hidden files (like it should be anyway).

Now look for three files (I found three) that start with "furj" and move them to your main C: drive (or some other folder you made, just get them out of there). One of them is a ".exe" so make sure it's really moved out!

If this messes up something you can always put them back, that's why we just moved them out. Now shut down again and start as usual then see if antivir detects the trojan anymore.

Another thing to check in these situations is what programs are starting up when you boot. You do that by going to Start->Run and then type in "msconfig" and click on the "startup" tab, it shows all things that startup and you can shut them off from there and see if that helps.

In this case, even if you turn them off, the "DLL" file was still there and it could re-infect the machine, so starting up in safemode and getting rid of the damn files is a good way.

Votes:

Rating: 0
Delete: 0
--- Replies to this Problem ---
From: Frank on 06/12/2005
Some other people have reported that epx30104.exe is the trojan downloader also known as "Lastad.h".

I have seen trojans that use random names, so the name of this thing needs to be identified by the "antivir" program, or your human skills may find it is the only thing you can't account for that starts up in the start up list.

This link is a good text about how you got infected and how you might keep from getting these things again.
http://boards.cexx.org/viewtopic.php?t=957

Or you can go here and install a real OS that doesn't get trojans! (and it's free, including "office" and mozilla)
http://mandrakelinux.com

Votes:

Rating: 0
Delete: 0
FAQ | Search     Post a Reply  

Home | About | Privacy & Security | Helpful Programs

Solar Energy News and more at the TechLuck Green Energy Forum

Copyright © 1999 thru 2024 Kronos Technologies Inc. All Rights Reserved.
See Terms and Conditions for more information.