Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Trojan horse

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: Trojan horse

Unread postby Shaba » August 2nd, 2009, 3:29 pm

So then please uninstall either avast! or AVG.

Let's try this then:

Download to the desktop:Dr.Web CureIt
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
  • Back at the main window, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found:
    Image
    If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
    Image
    This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log.
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland
Advertisement
Register to Remove

Im sorry

Unread postby the little boy » August 2nd, 2009, 8:03 pm

Hi
Apparently, it doesnt matter whether it was DrWebAntiVirus or eset or kaspersky. none of them can pass this file C:\Windows\System32\config\SOFTWARE.SAV .. what is that file :evil: ??? I saw the file .. can i remove the file? all the scan programs that you gave me are freezing when reaching this file. There MUST be something wrong
i wasn't able to carry on with your instructions .. i installed CureIt and it deleted some trojans (NtRootKit, StartPage, and BackDoor) and some adawares .. but no log files and no scan complete.
what am i supposed to do with SOFTWARE.SAV?? please HELP ME!!
the little boy
Active Member
 
Posts: 13
Joined: July 25th, 2009, 9:29 pm

Re: Trojan horse

Unread postby Shaba » August 3rd, 2009, 12:04 am

That likely means that your registry is corrupted.

You don't have any windows CDs?
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Trojan horse

Unread postby the little boy » August 3rd, 2009, 12:55 am

First Of All I really want to thank you sir for helping me this far. I feel i learned a lot in this forum. :)
Second. I just noticed something. after i stopped DrWebCureIt and restarted the computer, i opened firefox and nothing popped up(it used to show trojan generic 14.DYJ by AVG before) but now its not there! :) . Although, it suddenly popped up a while after when i was offline and just using the computer. what does that mean? and what should i do with these files on my desktop? MalwareBytes, RSIT, ERUNT, NTREGOP, fix.reg, and Dr web Cure it. can i use any of them before i go for the last option? ( reformatting)
I do have 4 CDs which came with the dell box. they are: operating system(vista home sp1 32 bit). application (powerDVD .. ) . Drivers and Utilities (dell inspiron 1545) and Microsoft Works.
which one should i use?

Thanks again.

Z
the little boy
Active Member
 
Posts: 13
Joined: July 25th, 2009, 9:29 pm

Re: Trojan horse

Unread postby Shaba » August 3rd, 2009, 1:40 am

That is glad to hear :)

Most of those will get removed in final instructions.

I don't think that reformatting is needed.

Do you have had any problems with registry or any registry related error messages before using ERUNT?
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Trojan horse

Unread postby the little boy » August 3rd, 2009, 2:21 am

well thanks!!
I haven't dealt with the registry before. but AFTER installing ERUNT i have had error messages when i turn the computer on. this is how they look like:

unable to create file
C:\Windows\ERDNT\Auto\8-3-2009\ERDNT.INF

Registry backup will continue, but no restore information fro the ERDNT program will be saved. This means that later restoration of the registry can only be done manually, by using another OS to copy back the files
--- and when i press OK it shows:

Error saving file
C:\Windows\ERDNT\Auto\8-3-2009\SECURITY !

continue with the next file?

if i keep pressing OK it changes from SECURITY to SYSTEM and so on for about ten error messages but if i click NO they all cancel
is this of any importance? because you asked whether i have had problems with the registry.
and what if those trojans pop up again what do you recommend? because i saw them once
thanks :D
the little boy
Active Member
 
Posts: 13
Joined: July 25th, 2009, 9:29 pm

Re: Trojan horse

Unread postby Shaba » August 3rd, 2009, 5:24 am

OK, those error messages do mean that windows registry is not as it should be.

Please try step 4. suggested here in last post :)
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland

Re: Trojan horse

Unread postby Shaba » August 6th, 2009, 10:59 am

Due to lack of response this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
Shaba
Admin/Teacher Emeritus
 
Posts: 26974
Joined: March 24th, 2006, 4:42 am
Location: Finland
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 290 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware