Home > Infected By > Infected By Toraja.Gen Virus: Unable To Open Any Excel Related Files

Infected By Toraja.Gen Virus: Unable To Open Any Excel Related Files

The Excel program keeps asking me that the Start12.xls is not found everytime I tried opening a file. http://www.sophos.com/virusinfo/analyses/trojkillavah.html Flag Permalink This was helpful (0) Collapse - Troj/Bdoor-CES by Marianna Schmudlach / June 1, 2004 11:51 PM PDT In reply to: VIRUS ALERTS - June 2, 2004 Aliases Trojan.AOL.Casey.b, Disruptive posting: Flaming or offending other usersIllegal activities: Promote cracked software, or other illegal contentOffensive: Sexually explicit or offensive languageSpam: Advertisements or commercial links Submit report Cancel report Track this discussion It creates an excel file named START*.XLS in the XLSTART directory of Microsoft Excel. Source

All rights reserved. Generated Sun, 12 Feb 2017 17:34:29 GMT by s_wx1208 (squid/3.5.23) ERROR The requested URL could not be retrieved The following error was encountered while trying to retrieve the URL: http://0.0.0.7/ Connection Once reported, our moderators will be notified and the post will be reviewed. The process of installing the Trojan typicallyincludes the creation of several folders under C:\recycler\. https://forums.techguy.org/threads/infected-by-toraja-gen-virus-unable-to-open-any-excel-related-files.159810/

It runs on Windows 95, 98, ME, NT, 2000, and XP. http://www.sophos.com/virusinfo/analyses/of97torajag.html Flag Permalink This was helpful (0) Collapse - XM/Toraja-G by Marianna Schmudlach / June 2, 2004 1:43 AM PDT In reply to: VIRUS ALERTS - June 2, 2004 Type Excel After a document is infected, an additional module named SERUM25 is created within the document. (NOTE: * represents a number).

Your cache administrator is webmaster. It infects the Normal.dot file (Microsoft Word) or inserts a copy of the infected workbook in the \XLStart folder with the file name Start12.xls. The system returned: (22) Invalid argument The remote host or network may be down. http://www.sophos.com/virusinfo/analyses/trojservui.html Flag Permalink This was helpful (0) Collapse - Troj/Bizex-D by Marianna Schmudlach / June 1, 2004 11:46 PM PDT In reply to: VIRUS ALERTS - June 2, 2004 Type Trojan

In order to run automatically when Windows starts up Troj/Bdoor-CES creates the following registry entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\caseyvid Troj/Bdoor-CES attempts to download a configuration file from a remote website. Advertisement justice_boy Thread Starter Joined: Aug 26, 2003 Messages: 5 I'm currently running in Windows 98 SE, My excel 2000 is currently infected by the Toraja.Gen virus, which can easily be The Trojan copies itself to the Windows folder as caseyvid.exe. This macro virus achieves this by hooking the following AutoMacros: AUTOEXEC() AUTOOPEN() AUTO_OPEN() Analysis by: Berman Enconado

Solution Solution Minimum scan engine version needed:6.810 Pattern file needed:1.923.00 Pattern release

It also opens backdoors on TCP ports 113 and 3067.W32.Korgo.E is compressed with UPX compressor.--------------------------------------------------------------------------------Note: Virus definitions version 60408w (extended version 4/8/2004 rev. 23) detect this threat as Bloodhound.Packed.--------------------------------------------------------------------------------Type: Worm Infection Many standard menu functions are overridden, making them inaccessible. Advertisements do not imply our endorsement of that product or service. Quick Links Glossary of Terms Help Tell us what you think of the Threat Encyclopedia! Solution: Important Windows ME/XP Cleaning Instructions Running Trend Micro Antivirus Systems infected with this malware can be cleaned by simply scanning for and deleting files detected as X97M_TORAJA.C.

More: http://www.sophos.com/virusinfo/analyses/trojisapassa.html Flag Permalink This was helpful (0) Back to Spyware, Viruses, & Security forum 22 total posts Popular Forums icon Computer Help 51,912 discussions icon Computer Newbies 10,498 discussions icon https://www.cnet.com/forums/discussions/virus-alerts-june-2-2004-24537/ The system returned: (22) Invalid argument The remote host or network may be down. Your cache administrator is webmaster. Digladio replied Feb 12, 2017 at 8:35 PM Want to install IE8 - but.......

Advertisement Recent Posts Win 10 fails to load, likely... this contact form http://www.sophos.com/virusinfo/analyses/trojnethidea.html Flag Permalink This was helpful (0) Collapse - W32/Randon-AI by Marianna Schmudlach / June 2, 2004 1:47 AM PDT In reply to: VIRUS ALERTS - June 2, 2004 Type Win32 In Word it infects the Normal.dot template, and in Excel it contaminates the \XLStart folder with an infected Excel workbook. SHOW ME NOW CNET © CBS Interactive Inc.  /  All Rights Reserved.

Staff Online Now crjdriver Moderator Macboatmaster Trusted Advisor Advertisement Tech Support Guy Home Forums > Software & Hardware > Business Applications > Home Forums Forums Quick Links Search Forums Recent Posts Tech Support Guy is completely free -- paid for by advertisers and donations. Generated Sun, 12 Feb 2017 17:34:29 GMT by s_wx1208 (squid/3.5.23) ERROR The requested URL could not be retrieved The following error was encountered while trying to retrieve the URL: http://0.0.0.10/ Connection have a peek here Generated Sun, 12 Feb 2017 17:34:29 GMT by s_wx1208 (squid/3.5.23)

Infected by Toraja.Gen Virus: unable to open any Excel related files Discussion in 'Business Applications' started by justice_boy, Aug 27, 2003. Please try the request again. And if you run regedit navigate to this key: HKEY_USERS\S-1-5-21-3341562259-4036164967-2552189465-1006\Software\Microsoft\Office\10.0\Common\General do you see in the Right hand pand the Value name: Xlstart And the Value Data: XLSTART http://securityresponse.symantec.com/avcenter/venc/data/o97m.toraja.gen.html Did you delete

crjdriver replied Feb 12, 2017 at 8:10 PM Loading...

justice_boy, Aug 28, 2003 #3 This thread has been Locked and is not open to further replies. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended. Troj/Ovedil-B is activated as an HTM file that is compiled inside a CHM file withthe names idx.htm and iexpl.chm. Please start a New Thread if you're having a similar issue.View our Welcome Guide to learn how to use this site.

managed replied Feb 12, 2017 at 8:21 PM Can't use all ram slots. I already tried cleaning with McAfee Anti-Virus (Updated everyday) 3 times just in case, I also already tried uninstalling, reboot, then re-installing my Microsoft Office, but to no avail. Please try again now or at a later time. Check This Out Track this discussion and email me when there are updates If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and

Generated Sun, 12 Feb 2017 17:34:29 GMT by s_wx1208 (squid/3.5.23) ERROR The requested URL could not be retrieved The following error was encountered while trying to retrieve the URL: http://0.0.0.9/ Connection Sorry, there was a problem flagging this post. The Trojan then adds the following registryentry so that it is started on user logon: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\zztp Troj/Bizex-D also creates two DLL files (_kwui.dll, _kwuiex.dll) and places them into the Windows System For example, by default on XP, this is c:\WINDOWS\system32) It creates the following registry entries, presumably with the intention of running the trojan again at startup, but it does not function

Style Default Style Contact Us Help Home Top RSS Terms and Rules Copyright © TechGuy, Inc. W32/Agobot-ZJ copies itself to the Windows system folder as SMSSL.EXE andcreates the following entries in the registry to run itself on system restart: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Config Manager HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\System Config Manager More: http://www.sophos.com/virusinfo/analyses/w32agobotzj.html The email has the following characteristics: Subject: Fw: give some ...Attachment: Variable file name.This worm also adds comments to .vbs, .vbe, .htm, and .html files in the root folder of the Stay logged in Sign up now!

http://www.sophos.com/virusinfo/analyses/trojservuk.html Flag Permalink This was helpful (0) Collapse - Troj/Isapass-A by Marianna Schmudlach / June 2, 2004 1:55 AM PDT In reply to: VIRUS ALERTS - June 2, 2004 Aliases TrojanSpy.Win32.Isapass SilverSurf replied Feb 12, 2017 at 8:28 PM Windows 2000 Pro L Henry replied Feb 12, 2017 at 8:24 PM Can't open any exe! However, Trend Micro strongly recommends that you update to the latest version in order to get comprehensive protection. Click here to join today!

Newer Than: Search this thread only Search this forum only Display results as threads Useful Searches Recent Posts More... Could anybody help me out? This site is completely free -- paid for by advertisers and donations. Show Ignored Content As Seen On Welcome to Tech Support Guy!