I think i have a trojan, need help!

[Tampa]

My PC started to go nuts last night after logging off of Bc2. I was getting errors upon errors of all kinds of crap and it did not stop untill i manually turned of my PC. Once i turned it back on i tried to get online to research this issue and now i cannot connect to the web on my original user account for Windows 7. I had to make a new user account to be able to connect. Please, if anyone here knows what steps i should take to get rid of this virus/trojan/ whatever it is, let me know! Thanks in advance!

PC specs are
HP Model p6310y
6GB Ram
Windows 7 64 bit Home Permium
1TB HDAMD Athlon II x4 630 Processor 2.80 GHz

[[Expletive Deleted]]

Re: I think i have a trojan, need help!

It depends on what it's doing. Did a fake anti-virus pop up and start taking over?
On machines with issues, I usually run Malwarebytes first if their normal AV didn't get the job done. http://www.malwarebytes.org/
Then I look up whatever errors it's showing. Rogue AV programs usually require registry editing to get rid of them. I just cleaned an LTC's laptop at work today, he had a Security Tools infection.

Another thing that they like to do is change your proxy settings so you can't get to anything outside for help.

[Tampa]

Re: I think i have a trojan, need help!

Yep, Fake AV popped up and i believe its blocking me from connecting to the internet. Ill run Malwarebytes and post a log as soon as its done.

[Tampa]

Re: I think i have a trojan, need help!

Weird. Its showing nothing. Do i have to be on the user account that i am having the problems with? Or does that not matter? Should i do a full scan rather than quick scan? I appreciate the help.

Malwarebytes' Anti-Malware 1.46

https://www.malwarebytes.org

Database version: 4412

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

8/10/2010 4:00:21 PM
mbam-log-2010-08-10 (16-00-21).txt

Scan type: Quick scan
Objects scanned: 121922
Time elapsed: 5 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[[Expletive Deleted]]

Re: I think i have a trojan, need help!

Also, search for the name of the rogue AV that popped up. Different ones have different files to delete and different registry keys to remove.

Yeah, a full scan needs to be done, not just a quick one. I always clean in safe mode with networking.

[Tampa]

Re: I think i have a trojan, need help!

Will do, ill post logs when done. Thanks man.

[Rambo]

Re: I think i have a trojan, need help!

Trojans need to be removed in "safe mode" because they live in memory and hidden files

[Tampa]

Re: I think i have a trojan, need help!

Here is the new log.
Malwarebytes' Anti-Malware 1.46

https://www.malwarebytes.org

Database version: 4412

Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385

8/10/2010 5:31:07 PM
mbam-log-2010-08-10 (17-31-07).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 420256
Time elapsed: 1 hour(s), 5 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files (x86)\Windows Live\Messenger\riched20.dll (Adware.MyWebSearch) -> Delete on reboot.

[[Expletive Deleted]]

Re: I think i have a trojan, need help!

You would still have to manually delete the links and files for the "antivirus," along with registry keys that make it keep going and getting rid of proxy information that makes it hijack your nets.

[Tampa]

Re: I think i have a trojan, need help!

I cannot remember the name of the fake AV. So basiclly, take it to a shop?

[[MyIS]Dan]

Re: I think i have a trojan, need help!

Get a bootable anti-virus: http://www.techmixer.com/free-bootab...download-list/

[Tampa]

Re: I think i have a trojan, need help!

Get a bootable anti-virus: http://www.techmixer.com/free-bootab...download-list/

Will look into these. Out of the ones on that list , what do you suggest?

[[MyIS]Dan]

Re: I think i have a trojan, need help!

I myself have used F-Secure and Avira Antivir to remove about 500+ viruses from a PC twice. Teenagers on porn sites results in major ****ed PC.

[Tampa]

Re: I think i have a trojan, need help!

In my case im thinking it was a lot of Bittorrent/Games. I appreciate the help Dan! Will post here with results!

[Tampa]

Re: I think i have a trojan, need help!

Ok so i have burned an iso from the above sites to a blank CD. When i restart my PC, i tap esc to go to boot menu, i select the CD to boot 1st, but nothing happens. It goes straight to Windows. Am i doing something wrong?