Computing.Net > Forums > Security and Virus > Trojan Horse

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Trojan Horse

Reply to Message Icon

Name: Jazzypha
Date: June 24, 2009 at 11:02:29 Pacific
OS: Windows Vista
Subcategory: Viruses
Comment:

How do I remove a trojan horse virus and will I loose all me files



Sponsored Link
Ads by Google

Response Number 1
Name: jdk (by neoark)
Date: June 24, 2009 at 11:47:37 Pacific
Reply:

Download and run Kaspersky AVP tool: http://devbuilds.kaspersky-labs.com...
Once you download and start the tool:

# Check below options:

    * Select all the objects/places to be scanned. 
    * Settings > Customize > Heuristic analyzer > Enable deep rootkit search

# Click Scan
# Fix what it detects
# Attach Scan log/Summary to your next message.

Illustrated tutorial: http://img32.imageshack.us/img32/76...

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 2
Name: Jazzypha
Date: June 25, 2009 at 08:21:28 Pacific
Reply:

I will not lose any of my files correct


0

Response Number 3
Name: jdk (by neoark)
Date: June 25, 2009 at 08:32:23 Pacific
Reply:

no it will try to cure the file if can't it will ask you if you want to delete the infected file.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 4
Name: Jazzypha
Date: June 25, 2009 at 08:45:48 Pacific
Reply:

Ok!! It is scanning the computer now. What is the next step?


0

Response Number 5
Name: Jazzypha
Date: June 25, 2009 at 23:00:44 Pacific
Reply:

What is the scan log summary. I closed the program but I have to re scan my computer. Where do I find this information from?


0

Related Posts

See More



Response Number 6
Name: jdk (by neoark)
Date: June 26, 2009 at 06:36:17 Pacific
Reply:

http://avptool.virusinfo.info/en/im... << At the botton you will see reports button with arrows. Arrows will flip through different reports. Go to your last report and press that button.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 7
Name: Jazzypha
Date: June 26, 2009 at 21:28:54 Pacific
Reply:

I can't arrow over for the last report. and when I click reports it says previous and next but you c ant click on it either. The only thing that I can do is a save to file. Nothing more. What do I do


0

Response Number 8
Name: jdk (by neoark)
Date: June 27, 2009 at 06:44:28 Pacific
Reply:

Save to file .txt, zip it and upload it to rapidshare.com and post the download link.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 9
Name: Jazzypha
Date: June 27, 2009 at 08:45:49 Pacific
Reply:

Here you go!!!
http://rapidshare.com/files/2492674...
MD5: 122ADF3677B0A86C533DE3C5FB20F2B8


0

Response Number 10
Name: jdk (by neoark)
Date: June 27, 2009 at 08:58:16 Pacific
Reply:

Does norton still detect a virus?

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 11
Name: Jazzypha
Date: June 27, 2009 at 09:09:55 Pacific
Reply:

I think it was a free trial. A norton think keeps popping up on the computer but they want me to buy it. There is a symatic anti virus that is on my computer though


0

Response Number 12
Name: Jazzypha
Date: June 27, 2009 at 09:20:16 Pacific
Reply:

There is a pc check up but I dont think its a protection


0

Response Number 13
Name: jdk (by neoark)
Date: June 27, 2009 at 09:39:58 Pacific
Reply:

Note: I can help you remove malware manually. Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible. First Track this topic. Then follow:

1) Can you please post your AVZ log:
Note: Run AVZ in windows normal mode. If avz.exe doesn't start, then try to rename the file avz.exe to something else and try to run it again. Make sure you have your web browser open in background before following the steps below.

i) To create the log file, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

ii) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

iii) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator.

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteAVUpdateEx( 'http://avz.virusinfo.info/avz_up/', 1, '','','');
ExecuteStdScr(3);
RebootWindows(true);
end.


Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

2) Download and Run DDS which will create a Pseudo HJT Report as part of its log: DDS Tool Download Link. When done, DDS will open two (2) logs

   1. DDS.txt
   2. Attach.txt

Upload the logs to rapidshare.com and paste download link in your next reply.
Note: Disable any script-blocking programs and then double-click on the DDS.scr icon to start the program. If you did not disable a script-blocker that may be part of your antimalware program, you may receive a warning from your antimalware product asking if you would like DDS.scr to run. Please allow it to do so.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 14
Name: Jazzypha
Date: June 27, 2009 at 09:53:48 Pacific
Reply:

Ok the norton check just finished. They say one problem is found. They say the next step is to actually buy the Norton 360. It says the performance was fair.


0

Response Number 15
Name: Jazzypha
Date: June 27, 2009 at 09:56:41 Pacific
Reply:

Can I close the Kaspersky scan. And can it be uninstalled


0

Response Number 16
Name: jdk (by neoark)
Date: June 27, 2009 at 10:15:13 Pacific

Response Number 17
Name: Jazzypha
Date: June 27, 2009 at 10:51:52 Pacific
Reply:

It will not let me paste the wording in the log part of the application. I tried right click and ctrl and V


0

Response Number 18
Name: Jazzypha
Date: June 27, 2009 at 11:02:16 Pacific
Reply:

Also, do I click all the drives on my computer on the application


0

Response Number 19
Name: jdk (by neoark)
Date: June 27, 2009 at 11:09:58 Pacific

Response Number 20
Name: Jazzypha
Date: June 27, 2009 at 11:22:27 Pacific
Reply:

http://rapidshare.com/files/2493144...
MD5: 1385E5D92E9F2CC52D7A10A292B52FF0


0

Response Number 21
Name: jdk (by neoark)
Date: June 27, 2009 at 11:28:25 Pacific
Reply:

Wrong file please read Response Number 13 carefully.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 22
Name: Jazzypha
Date: June 27, 2009 at 11:50:09 Pacific
Reply:

http://rapidshare.com/files/2493228...
MD5: 340EF95EA8C4862DE041DC908241F682


http://rapidshare.com/files/2493231...
MD5: 16CB3C06E55E9DD78F506EF44B8966E0


0

Response Number 23
Name: jdk (by neoark)
Date: June 27, 2009 at 11:52:40 Pacific
Reply:

Still need: virusinfo_syscure.zip

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 24
Name: Jazzypha
Date: June 27, 2009 at 12:00:27 Pacific
Reply:

http://rapidshare.com/files/2493260...
MD5: 1385E5D92E9F2CC52D7A10A292B52FF0


0

Response Number 25
Name: jdk (by neoark)
Date: June 27, 2009 at 12:06:31 Pacific

Response Number 26
Name: Jazzypha
Date: June 27, 2009 at 12:14:50 Pacific
Reply:

http://rapidshare.com/files/2493300...
MD5: A7C66C586E155D5035044667F7D96807


0

Response Number 27
Name: jdk (by neoark)
Date: June 27, 2009 at 12:36:37 Pacific
Reply:

Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step:

1) Run this script in AVZ like before, your computer will reboot:

begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}');
 QuarantineFile('C:\Windows\Downloaded Program Files\popcaploader.dll','');
 DeleteFile('C:\Windows\Downloaded Program Files\popcaploader.dll');
BC_ImportDeletedList;
ExecuteSysClean;
SetAVZPMStatus(true);
BC_Activate;
RebootWindows(true);
end.

2) After reboot execute following script in AVZ:

begin
CreateQurantineArchive('C:\quarantine1.zip');    
end.


A file called quarantine1.zip should be created in C:\. Upload that file to rapidshare.com and Private message me download link.

Is your original problem solved?

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 28
Name: Jazzypha
Date: June 27, 2009 at 13:19:55 Pacific
Reply:

http://rapidshare.com/files/2493478...
MD5: 3EE3E037DDD010E4DB5ED51D909A61DD

The auto protect screen still pops up when I start my computer up and it says the Trojan Horse virus is quartined. Also after the scan was done I had 1152 trojan virus and when the ones that wwere able to be removed there were still 452 virus


0

Response Number 29
Name: jdk (by neoark)
Date: June 27, 2009 at 13:25:12 Pacific
Reply:

Follow these Steps in order numbered. Don't proceed to next step unless you have successfully completed previous step:
1) Attach a Combofix log, please review and follow these instructions carefully.

Download it here -> http://download.bleepingcomputer.co...

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please upload that file to rapidshare.com and paste the link here.

2) Please zip up C:\qoobox\quarantine and upload it, to a filehost such as http://rapidshare.com/ Then, Private Message me the Download links to the uploaded files.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 30
Name: Jazzypha
Date: June 28, 2009 at 21:15:26 Pacific
Reply:

Ok. I dont know how to do this and it is making me a bit nervous. I tried to disable the antivirus and this message popped up and kept saying that it wasnt and information mihgt be lost. Thank you for your help but I believe that it is beyond my fixing. If I need anymore help I will contact you. Thanks


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links

Ads by Google


Results for: Trojan Horse

trojan horse optix www.computing.net/answers/security/trojan-horse-optix/583.html

NetBus Trojan Horse www.computing.net/answers/security/netbus-trojan-horse/13653.html

Trojan horse BHO.BHJ removal www.computing.net/answers/security/trojan-horse-bhobhj-removal/21691.html