I think i have a trojan, need help!

[signa]

Re: I think i have a trojan, need help!

I fixed a friends computer with a similar "fake antivirus". It was very hard to get rid of. I had to download a program called RKILL (it came with 4 types .com .bat .scr and something else).
Put them on a flash drive along with new installer of malwarebytes.
you need to download these from a non-infected computer.
boot in safe mode w/ networking to an admin account.
run rkill, it will force quit all non essential processes, then install malwarebytes, update the definitions and do a scan.

[[Expletive Deleted]]

Re: I think i have a trojan, need help!

I basically did the same thing to stop the processes, only manually. The problem is, as soon as explorer restarted the rogue AV did as well. So I booted into Safe Mode where the processes wouldn't run in the first place. Then I found and deleted the main file, which was something like 5991934.exe. Then I searched the registry for any keys referencing that number and deleted them. Then I found the .lnk file in startup and removed that. Ran Malwarebytes and had it clean the remainders. Then deleted the proxy settings in IE that the rogue AV had set up.

Guy's PC was clean after all that and I got $50 and a steak dinner out of the deal.

[CptainCrunch]

Re: I think i have a trojan, need help!

I remove this thing all the time. The creators make updates to it often so it takes some time for programs to detect it. There are a lot of steps involved in removing it, so I recommend you take it in, if you have items you want to save on the OS. Otherwise I would back up your system and start over. Save you some time and money.

Crunch

[Tampa]

Re: I think i have a trojan, need help!

Argh thats not what i wanted to hear, but thank you guys. I saved me a lot of time trying to figure this out. Im going to take it to a shop where they can deal with it. Thanks again everyone!

[[Expletive Deleted]]

Re: I think i have a trojan, need help!

I've cleaned rogue AVs three times in the last month, once from my wife's PC, once from my in-law's business PC, today from an officer's personal laptop. Some Google and some digging in files/registry and they've all ended up clean as far as anyone can tell. Funny thing: some people have told me that only IE is subject to attacks. The in-law's work PC was running FireFox...

Meh. I never pay to have someone do anything I can do myself unless it takes a LOT of time or education more extensive than what I can learn online in a short period of time.
I do most of my own work on my cars, electrical, carpentry (light) and plumbing work in my house, anything with my PC... I'm thinking about learning some more medical stuff to supplement what I already know, just to save on medical bills.

[[MyIS]Dan]

Re: I think i have a trojan, need help!

Ok so i have burned an iso from the above sites to a blank CD. When i restart my PC, i tap esc to go to boot menu, i select the CD to boot 1st, but nothing happens. It goes straight to Windows. Am i doing something wrong?

Did you burn it on another PC? Tried it on another PC?

[TheHeartSmasher]

Re: I think i have a trojan, need help!

What antivirus where you running before the issue started?
Have you tried running Kaspersky or Bitdefender?
Do a clean boot by opening up msconfig go to services check hide all Microsoft Services then press Disable All except for your antivirus, then go to startup and press Disable All except for your antivirus.
Post a HiJackThis log, make sure you rename it before your run it.

[TheEn|gma]

Re: I think i have a trojan, need help!

My step-dad got a similar virus last week on his laptop managed to remove what I assume to be most of it but it's started running as fast as something from the 90s now, the advice in this thread is good. It was AntiVirusGT on his which mimics AVGs UI almost identically, save the logo very easy for people not in the know to fall for.

[LunaTiK TunaLiK]

Re: I think i have a trojan, need help!

Guys, anytime you get a virus like this you need to go to a forum like http://forums.whatthetech.com/ and they'll help you out.

The suggestions people are making in this thread could do more harm than good.

[[MyIS]Dan]

Re: I think i have a trojan, need help!

The suggestions people are making in this thread could do more harm than good.

How so?

[LunaTiK TunaLiK]

Re: I think i have a trojan, need help!

How so?

Because he's been infected with a rootkit virus which is going to be accompanied by mutliple viruses and malware and going to take just as much luck as professional help to clean. Any help that isn't professional is just going to make it that much more difficult to fix.

If you've been infected with a virus that has locked you out of your own internet and or programs running anti-malware/virus programs can have you delete/quarantine files that you need running to fix in the first place.


It's going to be a multiple step fix and 1 program isn't going to do the job. Knowing how to read logs from hijack this, GMER, and OTL is the most important help right now. The only easy fix is going to be a clean wipe with a new install.

[CptainCrunch]

Re: I think i have a trojan, need help!

Because he's been infected with a rootkit virus which is going to be accompanied by mutliple viruses and malware and going to take just as much luck as professional help to clean. Any help that isn't professional is just going to make it that much more difficult to fix.

If you've been infected with a virus that has locked you out of your own internet and or programs running anti-malware/virus programs can have you delete/quarantine files that you need running to fix in the first place.


It's going to be a multiple step fix and 1 program isn't going to do the job. Knowing how to read logs from hijack this, GMER, and OTL is the most important help right now. The only easy fix is going to be a clean wipe with a new install.

Yep, if not done correctly this thing will just rebuild itself and start again within a few days. Ive had to bring in many computers from business to get them cleaned. The customers always complain and I always tell them its the only way to fully get the system clean.

Good luck though.

Crunch