[ladyknight]

Where do I start?

Several days ago when I turned on the pc, TrendMicro popped up saying I needed to reboot to get rid of this trojan called Worm_downad.a. I did that.

Then about 1 hr. later I noticed that my pc was running at 52% and I didn't have anything open. I tried to update Trend again and could not get to the site. I tried other antivirus sites, all blocked.

I found a site and proceded to do the 8 steps, but to no avail. I did manage to get MBAM. I ran that and it found several. It cleaned it. It said it needed to reboot to finish deleting the files. I had already turn system restore off.

I rebooted and once again tried to get to Trend...could not. I did manage to get the manual removal from Trend through someone else.

I cannot get to Microsoft either for their updates. Seems that is where this all began.

I have ran several programs in safe mode. It seems clean however I still cannot get to any antivirus sites or update Trend.

Any suggestions?

[OGUNIT]

ouch LK. i hate computer problems . Yesterday after i logged on , my computer started acting all bad. The macafee couldnt cath it and same with fire fox . so i just refreshed my computer to an earlier state and now i can work on it and surf and fix stuff. SOMETHING is going on .

[Merc420]

Some kinds of virus's suck real bad. As you turned off your system restore which is not a smart idea there's not much you can do. The only other options i would suggest is a clean install. You won't loose your data if you do it correctly. Or i could try to send you AVG 8.0 through aim and see if you can install it. But if its a bad trojan then it won't let you install anything.

[juangoodman]

I at one time was a trend PC illin user until I received a trojan and my PC crashed. Prior to that I was using Norton Internet security and it used a lot of RAM and slowed my PC dramatically. I did some research and found Kaspersky Internet Security software to be recommended by several techies. I highly recommend it.

If you are just using an Anti Virus program, I highly advise you upgrade to a full Internet Security Suite vendor. Just running a Anti virus program is not enough these days. I wish I had an answer for you but it seems that you are infected and may not be able to delete the virus. It's possible you could just reformat the hard drive and reinstall all your programs ( a real pain in the ass) but depending on the virus you may not be able to.l I would try Kaspersky and if that does not work there is a great company that charges by the hour called "Make it work". A tech is dispatched to your house and they are all very knowledgeable. I have used them on a couple of occasions and they did a great job. The charge I believe is $125 for the first hour. This is their number if you wish to use them: 818.232.7936. Good luck, just wish I could be of more help.

[jokerdewd]

One successful program I used was Anti-Malware to remove the virus.
Todays virii will not let you download or install or use any of your anti virus programs.
The best way to uninfect is to install your hard drive as a secondary device in another computer and run the anti virus program from the other machine.

[ladyknight]

I was able to run them in safe mode. Trend caught it but to now avail. I was able to go to download.com and downloaded a couple of programs. 1 program did catch it again plus a couple more that Trend did not. I have the whole suite for TREND.

I did use a Anti-malware which did find them. I have ran them several times now and pc is clean, but still can't get to sites.

I am transferring my doc's to a external drive right now. I have been to tech boards. Gave them logs, etc. to no avail.

The only solution I see is reformatting the HD, unless I find something.

[Fisherman Bob]

It seems like your chasing your tail.I would suggest backing up you system and reinstalling windows.DON'T USE NORTON!!!!! I have been fixing computers for to long and this is what I suggest.My computer is just about in the same place but fighting about the time to fix it(JUST ONR MORE DAY)!!!

FISHERMAN BOB

PS DID I SAY DON'T USE NORTON!!!!!!!!!!!BAD MOJOE...

[ladyknight]

Thanks for the help :) No, I don't use Norton. I use TrendMicro, or did till this. I will be calling them tomorrow.

[ps-med]

I have been very happy with Trend Micro. I often recommend them.

What specifically is happening when you try to go to the various sites?

Have you ran a HiJackThis scan?

Do you have system restore enabled? Have you tried restoring to a point before the problems?

Mark (paid geek in real life)

[abrakadabra]

I've never caught a virus luckily, been over 15 years.

I do have everything backed up JIC though, I don't have anything stored on my main hard drive so it makes it that much easier to just do a clean install if anything were to ever happen.

I've had drives crash and things like that, so having everything on a slave drive saves the day every time. Also configured RAID so it backs up the slave.

[firemonkey]

Ladyknight, I have had very good results with AVAST. They have a "cleaner" as well as protection. It's quite talked about recently, and quite highly rated. The home version is free.

http://www.avast.com/eng/avast_4_home.html

[MadRiverTurtle]

Trojan Update: the virus ate LK. She has been stolen from us and now lost in cyberspace.


JK! :slaugh:

[tomo7]

My "Trend" showed a Trojan virus after a scan this A.M. but it seems to have taken care of It. So I think & Hope.

[stealthviper]

Originally Posted by MadRiverTurtle

Trojan Update: the virus ate LK. She has been stolen from us and now lost in cyberspace.


JK! :slaugh:

CEILING CAT IS LOOKING FOR TROJANS! ALSO WE HAS LADYKNIGHT HERE WIT US! GIVES US ALL NUGZ-NO TROJANS, PLEASE, 'CAUSE WE FIXT!

[mkylky]

i'm sorry to hear about your tech troubles.

i've had a flawless running system for past few years using NOD.32 anti-virus. spysweeper for spyware. and ccleaner to clean cache/temp files/broken registry entries.

my suggestion is to start in safe mode, do a ctrl+alt+delete and see if there are any odd processes running. then google the process and see if its malware, oftentimes specific trojans have very specific remedies.

i hope this helps a little.

for future, best to do is have your harddrive partitioned, and have a dedicated partition for the OS, to making reformatting easier and more convenient when needed.

[delta9gamma]

FYI for all,

a new bug has been found in Microsoft Internet explorer that could allow all sorts of bad things. i believe an update is available.

Adobe acrobat reader also has a recently discovered flaw.

updating both will go along way in preventing infections

[mkylky]

Originally Posted by delta9gamma

FYI for all,

a new bug has been found in Microsoft Internet explorer that could allow all sorts of bad things. i believe an update is available.

Adobe acrobat reader also has a recently discovered flaw.

updating both will go along way in preventing infections

very good to know. thanks for the heads up. some could use.

i recommend using firefox for browsing.

and foxit reader for PDF files which is an open source program and uses less system resources as well.

[C.C.C.N.]

The one thing i learned about trojan viruses, when i got one a year or so ago, was that you cant just run a virus program then reboot your computer to delete it. In fact i learned that rebooting was the worst thing to do becuase if you didnt delete the proper infected files the reboot will cause it to spread to other files somehow. When all was said and done with the virus i got, i had to reset my computer. Lost everything i had which luckily wasnt anything to important.

TROJAN viruses suck major ass

[Sterling]

trojan no good use magnum no trojan

i use nod32 and work good for me but i no do weird site or porn or site i dont know about is good to go only go safe site and no more. also backp evrything on maxtor 1touhc hardrive every couple day before go sleep just push button and backup all computer file

[Sterling]

i use backup before sleep so when wake all file backup no have wait to finish.
1tb cheap now too only like $100 for 1000gb no can beat that very cheap

[Fisherman Bob]

the name of the game is backup, backup, backup.I repair confuzzers all day long and there is no product that can keep you from getting a new virues,its about wrong place wrong time.The only way this could bee true is if the company is wrighting them.To many anti virus programs to make this possable.NOW WITH THAT BEING SAID I will say again backup backup backup then when you hava virues reformat and same yourself some time.Unless you like chasing you tail.

JUST MY GRAIN OF SALT

FISHERMAN BOB

PS: again norton has been the worst antivirus for about two years,was the best.

[ScrewyLewy]

OH so sorry LK. The only good that I can see you getting from all this is the advice.
Don't do anything not reversible yet someone might give you and simple fix no one else thought of. At least a couple of days.

Back up drive - make it an external or removable.
you can unplug it so your system wont infect it if it gets sick. You can put it in a safe place and in case of disaster you can put it in your suit case easier than a PC and leave.

Best of luck. Peace

[stanley]

First, sorry for your troubles LK, no one deserves this stuff....

Second, here is my prayer that the writers of all this malware, these virii, these trojans... all of this bad crap, here is my prayer that their little tiny private parts shrivel up and fall off...

Prevention is of course the best tool for these problems... I avoid "risky" sites like the plague... but that isnt good enough.

I have used most of the anti-virus programs... Norton(PTUI! never again), Trend, Kapersky, AVG.... and I have settled on Avast.

It is free for home use, it updates virus definition multiple times a week (sometimes multiple times a day), and since I have begun using it I have not had a single infection of any sort... (4 plus years)

I try to do all the things they tell you will lessen your exposure. I dont use Internet Exploder (except to watch Netflix streaming video).... I use Firefox, I NEVER click on links to places I dont know, I do MY best to avoid infections... but these malware creating LOWLIFE SCUM are getting better and better at getting the stuff into your computer.

This holiday season I read warnings from folks who had been infected.... when the plugged in their new digital PICTURE FRAMES to upload the pictures... the virus came from the picture fames....

I am running Windoze Vista Ultimate 64 bit... I use the firewall that is installed in it, I run Avast. No problems.

As to repairing your current situation... My advice is to re-format and start over. You will NEVER be comfortable that you were able to root out all the trojan's code, you will always wonder what else it is going to do...

I started setting up my computer with ONLY wiondows on C: drive... I install all my program software (Photoshop, Lightroom, Itunes, Firefox, Winrar etc etc) on my D: drive....

Just a separate partition for Windows.... then, when it is NECESSARY to re-install windows, I can format JUST the Windows drive(or partition) and do a clean install... I then just re-install my application software to re-establish the registry entries, with all my presets and data files normally safe and ready for use...

[kushguy101]

everything you did was sorta wrong starting with the weak anti virus. the net it just loaded with crap now a days. hit me up if you want a copy of kaspersky or eset nod antivirus. Top notch i'll burn you a copy. i can come clean your pc up for you if you like as well then leave you wioth some other spyware and registry cleaning tools. pm me

What you have is a rootkit. This one has been making the rounds. Most antivirs can't deal with sector offset MBR's or remove them. The one you have modifies the system thru windows SECPOL and adds a virtual machine, so you can't access the net and each time you reboot, it will come back.

If you haven't already reinstalled, I can tell you how to remove it. It cannot be done with antivir software, it has to be done with a sector editor to remove the MBR rootkit.

MBAM will detect most rootkits but cannot remove most of them. GMER will show you the disk location of the MBR so it can be edited out or disabled. gmer.net Run it and it will show a rootkit installed at sector 62.

This one also got me on my surfing box. Killing the extra MBR and setting SECPOL* back to defaults will fix it.

* I can give you a vbs script to do this