PDA

View Full Version : Trojan Horse issue

Pheebs
26-09-2010, 08:42
Hey Guys and Girls :)

Not been on here in ages (only time I seem to go on internet is to load of spotify/brief check of Bookface! Am mega busy otherwise! Hoping you're all well I do check in every so often :))

Having a problem with poota at the moment. SOmehow I've managed to acquire a trojan I think... it's put some "security" program "Security Tool" (unless this is a genuine program - not convinced it keeps asking for my card details - LIKELY!!!) on my computer which won't let me run any programs (avg included)/download anything and I can't get rid of it.

Not quite sure what to do :/

Any ideas... I'm clueless when it comes to things like this. Was wondering if there was an online scanner/trojan remover I could run?

Thank you BD peoples :) appreciative of any help!
Pheebs
26-09-2010, 08:43
Just looked up security tool and it is a pooped program. BUM!
Feek
26-09-2010, 09:19
You need to run malwarebytes, it's not an online scanner but something you download. It's pretty much the best tool for removing dodgy stuff. When you download it there's a chance that the scamware you've accidentally installed will stop it from running so you cheat by renaming the file you downloaded to explorer.exe
Stan_Lite
26-09-2010, 09:41
You need to run malwarebytes, it's not an online scanner but something you download. It's pretty much the best tool for removing dodgy stuff. When you download it there's a chance that the scamware you've accidentally installed will stop it from running so you cheat by renaming the file you downloaded to explorer.exe

Also, run it in safe mode. I always prefer to run in safe mode as a lot of nasties will put stuff in system restore which can't be removed in normal mode.
Feek
26-09-2010, 09:50
Yes, forgot that. Disable the system restore doofer first then reboot into safe mode.
Pheebs
26-09-2010, 10:15
Ooh la la!

I've managed to run soem software to get rid of I think the main part of the virus although when I restart in normal mode I cannot see my desktop and all. Looking under windows task manager I can access odds but hmmm. Any ideas why I cannot see anything?

Thank you for your help :)
Pheebs
26-09-2010, 11:42
hmmm. still hasnt got rid of security tool. Have run malwarebytes in safe mode and it says its got rid of all infections. when start back up normally security tool is still popping up.

Rubbish.

Does anyone know of a specific program that will wipe secuirty tool?
Mark
26-09-2010, 12:02
Security Tool is a bit of a **** to remove. I've had the misfortune to come across it before (though never remove it).

Here's the instructions I found last time (using Malwarebytes):

http://www.bleepingcomputer.com/virus-removal/remove-antivirus-vista-2010
Feek
26-09-2010, 12:08
I can't remember the name of the utility but there's one which you need to run before malwarebytes which kills any active incidents of the scamware. If you don't do that then the rogues processes will respawn while you're running malwarebytes.

Malwarebytes will do it, it's the best tool out there.
LeperousDust
26-09-2010, 13:07
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

ComboFix is the sledgehammer to crack them all usually. Read the tutorial on how to use it though first. It's not just your run once ignore program. Teamed with help from belepingcomputer your in good hands removing almost anything :)
Pheebs
26-09-2010, 18:47
I think... I think all is sorted!

*touch wood*

It's only taken a whole day!

Bah!


And all I was trying to do was download Legends of Zelda Spirit Walks and I didn't even get that in the end :(

Boo.

Hehehe! but thank you super much for all your help! I think the combofix got rid of all the redirecting to weird webpages and the malwarebytes finally managed to hunt down and clean out the silly security software!! WHOOP!

Still nervous though... hehe!
LeperousDust
26-09-2010, 19:04
Combofix is super powerful :)

Glad you got it sorted!
Davey_Pitch
26-09-2010, 20:13
Good links there. I had to try to remove it from a friends machine once and ended up doing the whole thing manually by finding and deleting all the relevant files and folders in Safe Mode, then killing a few registry entries that were trying to run it. Wish I'd known then there was an easier way!
Pheebs
27-09-2010, 13:39
Here for future reference where'd I find registry entries? I ended up trawling through loads of files to get rid of new rubbish! Boo!