[mxy0684]

Hi,

I am running XP Pro SP2. Long story short, I got the "default block bla trojan" (also seen it online called backdoor.bla) from my mom's laptop when I went to back it up via cross over cable. For her laptop I just did a simple format but my computer I have gigs of stuff for school so a format for me right now would be a major hassle.

I need to know how to remove the backdoor.bla trojan. I use Zone Alarm Pro and have norton system works 2005 and the norton internet worm protection gives me the following every time i connect to my dial up:

Details: Rule "Default Block Bla Trojan horse" blocked (204.215.201.XXX),1042).
Inbound UDP packet.
Local address,service is (localhost,1042).
Remote address,service is (204.215.201.XXX),1042).
Process name is "N/A".

The IP address above is the IP that i currently have as of this moment because I connected to post here. Localhost is obviously me as well, so i am stumped by how the local address is me and the remote address is me as well.

Now on norton's website it says to simply run a virus scan and it will detect and remove, well i ran 3 scans and nothing. I googled and found several sites with file names and registry values to look for, but to my luck I have none of them. If anyone has any info on how to get rid of this stupid trojan that would be great. I've posted here a few times before and got great results from you guys, hopefully someone can help me!

cheers

[Bad Karma[CORE]]

To remove the Trojan:
Run LiveUpdate to make sure that you have the most recent virus definitions.
Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
If any files are detected as Backdoor.Bla, first write down the file names, and then delete them.

NOTE: If NAV displays a message that it cannot delete the file, you must first remove the value that it added to the registry, restart the computer, and run the scan again.

To edit the registry:

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding.
Click Start, and click Run. The Run dialog box appears.
Type regedit and then click OK. The Registry Editor opens.
Navigate to the key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

In the right pane, in the Data column, look for a reference to the file name that you wrote down earlier (the file that NAV detected as infected). The entry in the Name column will vary, but the following have been reported:

System
IO System Debug

Delete the entry that refers to the Trojan file name.
Click Registry, and then click Exit to save the change.

Source: Symantec.com

If that didnt help let me know

[mxy0684]

thanks but that didnt help. I already found that on norton's site, maybe I didnt say that clearly in my first post..my bad. Anyways, I looked in all the run spots in the registry and nothing. i've done cleanups on the registry with 2 different apps also. As i said I found on google several random sites with bits and peices and with some file names to look for but I have found nothing. I've rooted thru the windows directory and other places a trojan might hide in but found nothing unusual. I also have hidden files viewable and found nothing. oh well. if anyone else knows of a solution that would be great, i'm probably going to be due for a format soon haha

cheers

[SICS]

Download the free version of AVAST www.avast.com and run the boot time scan it will scan your computer when the computer boots and should get rid of the virus with no issues.

[mxy0684]

SICS...i tried avast but it did not find anything.

however, i did some more googling and found a program called Anti-Trojan sheild. I downloaded the trial and ran it and it found the trojan. Norton, avast, and several free online ones couldnt find it. The infect files were ccrpbds6.dll and ccrpftv6.ocx. I deleted them before I realized I should have put em in a zip file and sent em to Symantec so that they coudl put it in the definitions. Hopefully this was it and i'm good to go now. Heads up to anyone else who gets Bla Trojan being blocked by Norton Worm Protection.

thanks for your help guys, really was appreciated.

cheers

[SICS]

Hi Mxy0684,

Glad to hear that you found that pesky trojan and got rid of it. Do you happen to have the download link for that program? It seems as it's some usefull software, and I think it would be good to place in the download section of the community.

[mxy0684]

http://www.atshield.com/ there is a link for a free download. In order to get updates you have to pay 30 bucks to register, but the program was able to find the trojan with its default definitions. its good for 30 days so it's def worth the download if you got a virus like me and nothing else works.

btw, i've rebooted now 2 times since my last post after I scanned and deleted the trojan and no norton alerts, so i think i'm in the good now

[SICS]

Thanks for the update! If you'd like you can post the information in the troubleshooting section (This way you'll get the credit )