My friend has some kind of pesky trojan, that prevents installation of new programs (antiviruses). I found LCLASS.EXE in the list of running processes. Deleting that process doesn’t help. I also tried to delete it (and svchots.exe) from windows\system32 dir, but they reinstall itself fairly quickly.
I tried online scan with Trend Micro, but it couldn’t finish.
What else can I try without reinstalling Windows XP?
You can try DrWeb CureIT! instead. Maybe downloading it in other computer and running it from an USB stick.
http://www.symantec.com/business/security_response/writeup.jsp?docid=2007-112311-3657-99&tabid=2
you could also delete the registry entry and the files by hand
whatever works
A-squared also has a version downloadable to a USB stick
Thank you Tech. I’ll try that.
I’ve read a post from Symantech, but it is no help for me. It doesn’t explain how to delete/modify reg entry. The trojan is preventing me from running executable files. I can’t start regedit, can’t open any item in Control Panel, can’t install programs.
Unfortunately I can’t start DrWeb CureIt on that computer either. When I click on DrWeb exec file(on USB stick), XP opens list of programs that already installed on it and asks which one to use for openning.
Change (correct) file associations… http://www.dougknox.com/xp/file_assoc.htm
Besides A-squared there is a way to run Spybot from a usb stick
this could be done in safe mode
can you run anything (avast) from safe mode?