Bloody computer question

[Fenris]

I run AVG as my virus scan, and yesterday it caught and quarantined a Trojan Horse. Today, when I started the machine up, all of my icons on the Start menu and the quick start icons on the start bar were black. The desktop icons were fine. But the others were black. I restarted several times, but nothing changed. Any idea what the problem could be, or how it can be remedied?

[kalian]

1. What file was quarantined?

The trojan horse might have gotten a hold of one of the files that
controls either the desktop or the icons.

[Fenris]

3. C:\WINDOWS\DESKTOP\LLASS.EXE

[kalian]

4. Searched:

http://www.windowsstartup.com/wso/browse.php?l=12&start=75&end=100

Troj/Inor-A is a backdoor Trojan that usually finds its way onto a user's system when a web page containing an encoded version of the executable is viewed. Troj/Inor-A will create itself on the Desktop using the filename llass.exe, and add the following registy entries that point to this filename to ensure the Trojan gets executed at system startup: HKLMSoftwareMicrosoftWindowsCurrentVersionRunlar HKLMSoftwareMicrosoftWindowsCurrentVersionRunServiceslar The following registry entry is also created: HKLMSystemCurrentControlSetControlSLP Troj/Inor-A has the ability to uninstall itself and change the port it is listening on via commands issued remotely.

[Fenris]

6. Thanks for the information

[kalian]

9. Might want to try downloading the WinXP Startup Inspector as well....

might find some stuff that is loading up when you start up your
box.

[kalian]

5. Another thing....

Download SpyBot and Ad-Aware. Update both programs and then
run a complete scan. I'm sure that you'll find some more malware
installed on your box.

[Wilber_Stool]

2. Try running

another scan. See what it picks up.

[starroute]

7. Try a Google Groups search

start menu icons black

This can happen for several reasons that don't necessarily involve your Trojan Horse. Several of the links that come up recommend settings changes that might help.

[Guy Fawkes]

8. Registry time!

LLASS.exe creates the following reg keys: HKLM/Software/Microsoft/Windows/CurrentVersion/Runlar HKLM/Software/Microsoft/Windows/CurrentVersion/RunServiceslar HKLM/System/CurrentControlSet/Control/SLP

go to "run" on the start menu, and run "regedit". Find those keys and kill them.

HKLM means "Hkey_Local_Machine"

[kalian]

10. Backup the registry first!!!!

before mucking around with it...