need help with a trojan !!!!!!

swerks · 09-20-2008, 08:16 AM

I have this nasty trojan, spy-agent.bw!rootkit my mcafee antivirus says its removed but I can scan again immediately and its still there. My computer no longer lets me communicate with mcafee or Microsoft for updates or help. I can still use email and communicate with some websites

This ad is not displayed to registered members.
Register your free account today and become a member on Yotatech!

***Corey*** · 09-20-2008, 08:41 AM

I have had some experience with removing spyware form infected machines.
I use AVG antivirus the paid version, and Webroots Spy Sweeper.

When I have cleaned up infected PCs, that kills it all.

You can get a free version of AVG at
http://www.avg.com/

For spyware, there are two good free ones.
Adaware
http://lavasoft.com/
Spybot Search & Destroy
http://www.safer-networking.org/index2.html

The latter one has to be run a few times, but it is a good product.

Some say you have to boot to Safe Mode when running these apps.
I never have, and they have cleaned up an infected PC just fine.

In this same forum section are older threads on how to remove spyware/viruses too.

And that tool with Windows called Windows Restore I think it is called, I never run it.
Your backups it keeps can contain a viruses and spyware, and it gets put back on again.
I back up all of my files by an external USB hard drive, so when it is time to clean the PC when it is running bad, I format, reinstall the OS, and then restore my backed up software.

swerks · 09-20-2008, 09:08 AM

it seems like every site that might help me I cant get too. I do and have run the adaware

***Corey*** · 09-20-2008, 09:36 AM

So the trojan must be blocking known URLs to helpful sites.
Bummer...

I know there are some on the forum here that can help, maybe they can chime in later.

I really do like the Webroots Spy Sweeper app I have, as it can block sites that have crap on them.

Look into getting that later when your PC is cleansed.

woodendude · 09-20-2008, 12:06 PM

macafee stinger. It's a stand alone utility that works great.

http://vil.nai.com/VIL/stinger/

***Corey*** · 09-20-2008, 12:35 PM

Swerks, if your PC will not let you get to the above site to get the exe file
http://download.nai.com/products/mca...ger1001602.exe
I can download it and host it on my site for you to grab from me.

89dlx · 09-20-2008, 12:59 PM

Any of those programs are good. I personally use "hijackthis" and "spybot search and destroy" when fixing other peoples computers.
It helps if you run the programs in "safe mode". Restart the computer and before you see anything on the screen, press F8 and keep pressing it until you get some text on the screen. Use the arrow key to get to the top selection and press enter.

swerks · 09-20-2008, 03:07 PM

I have been working in safe mode this thing is very frustrating I did try to down load the stinger without any luck how can this thing know every site that might help? any help you can give Cory would be much appreciated

***Corey*** · 09-20-2008, 03:21 PM

Sending PM to you with the 2.4 MB file.
My guess is the virus knows of the helpful sites.
If it blocks my site too, then it is something else in the virus.

toydp1224 · 09-20-2008, 04:25 PM

i got ride of a trojenn i had by going in to my temperary internet files and deleting every thing i had in there. it was kinda a hassel cuzz my passwords and such werent saved any more but 1000% worth it good luck also if it ses it is still running hit crtl+alt+delete and it will take u to a task menue and u can stop it from there and then delete it in your temp files hope this helps

scuba · 09-20-2008, 11:19 PM

try getting the actual file from someone elses computer, like burn it on a cd or such from theirs, take it to yours and get it done !

ozziesironmanoffroad · 09-21-2008, 06:17 AM

try deleting MCAFEE... you'd be surprised what your computer could do. Mcaffee IS the virus... delete mcafee and put AVG on there. or if you have to format the drive, take the ram out for a few minutes, then reload everything. that will clear anything.

swerks · 09-21-2008, 06:53 AM

I recieved the stinger It didnt work?? thanks for everyones efforts

woodendude · 09-21-2008, 08:01 AM

Should have also mentioned, if you're running XP turn off system restore run your anti virus apps. then turn system restore back on.

***Corey*** · 09-21-2008, 08:05 AM

I mentioned that above.

swerks · 09-21-2008, 09:06 AM

I have turned system restore off. None of my system tools work any way, I cant defrag, or clean up ???

swerks · 09-30-2008, 07:02 AM

Well, I am back up and running, had to completely reformat and reload O.S. lost some info,but like having a new computer again!

***Corey*** · 09-30-2008, 07:36 AM

Cool...
Get all of your Windows updates done, get a good virus scanner, and a spyware one too.

Set the virus app to auto download and apply the DAT files.
Most scanners update their DAT files daily.

This should help, and nothing like a freshly formatted disc.

js9924 · 10-12-2008, 08:04 AM

try this click on your start menu and then run.

Type msconfig in the window that opens then enter.

when the window opens select the option that says diagnostic startup. Click apply and then restart this will only load the basic services you need to run windows xp (which is what I assume you have).

If you feel up to it you can click on the tab that says startup and look for anything that shouldnt be there. meaning some software you didnt install yourself. Simply uncheck the box next to it and click apply.

Then when you are rebooted try to run the anti-virus/spyware software. This should not allow the virus program to start with windows and will be easier to remove.

Of course you can do what I do and create an unattended install and just reinstall the OS. Just google a thing called "nlite" without the quotes. Remember to back up your bookmarks and saved game files though. Good luck

09-20-2008, 08:41 AM	#2 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,018	I have had some experience with removing spyware form infected machines. I use AVG antivirus the paid version, and Webroots Spy Sweeper. When I have cleaned up infected PCs, that kills it all. You can get a free version of AVG at http://www.avg.com/ For spyware, there are two good free ones. Adaware http://lavasoft.com/ Spybot Search & Destroy http://www.safer-networking.org/index2.html The latter one has to be run a few times, but it is a good product. Some say you have to boot to Safe Mode when running these apps. I never have, and they have cleaned up an infected PC just fine. In this same forum section are older threads on how to remove spyware/viruses too. And that tool with Windows called Windows Restore I think it is called, I never run it. Your backups it keeps can contain a viruses and spyware, and it gets put back on again. I back up all of my files by an external USB hard drive, so when it is time to clean the PC when it is running bad, I format, reinstall the OS, and then restore my backed up software. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

09-20-2008, 09:08 AM	#3 (permalink)
swerks Registered User Join Date: Jul 2002 Location: Milwaukee WI Posts: 846	it seems like every site that might help me I cant get too. I do and have run the adaware __________________ 99 SR5 V6 Auto 4WD, deck plate, TRD exhaust, Donahoes/Bilsteins,cornfed spacers, Waag Nerfs, Wet Okole's, Load warrior, Optima red top 86 Turbo SR5 4Runner (work in progress)(Money pit)

09-20-2008, 09:36 AM	#4 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,018	So the trojan must be blocking known URLs to helpful sites. Bummer... I know there are some on the forum here that can help, maybe they can chime in later. I really do like the Webroots Spy Sweeper app I have, as it can block sites that have crap on them. Look into getting that later when your PC is cleansed. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

09-20-2008, 12:35 PM	#6 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,018	Swerks, if your PC will not let you get to the above site to get the exe file http://download.nai.com/products/mca...ger1001602.exe I can download it and host it on my site for you to grab from me. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

09-20-2008, 03:07 PM	#8 (permalink)
swerks Registered User Join Date: Jul 2002 Location: Milwaukee WI Posts: 846	I have been working in safe mode this thing is very frustrating I did try to down load the stinger without any luck how can this thing know every site that might help? any help you can give Cory would be much appreciated __________________ 99 SR5 V6 Auto 4WD, deck plate, TRD exhaust, Donahoes/Bilsteins,cornfed spacers, Waag Nerfs, Wet Okole's, Load warrior, Optima red top 86 Turbo SR5 4Runner (work in progress)(Money pit)

09-20-2008, 12:06 PM	#5 (permalink)
woodendude Registered User Join Date: May 2008 Location: Ottawa, On. Posts: 285	macafee stinger. It's a stand alone utility that works great. http://vil.nai.com/VIL/stinger/

09-20-2008, 12:59 PM	#7 (permalink)
89dlx Registered User Join Date: Oct 2006 Location: Branford, CT. Posts: 932	Any of those programs are good. I personally use "hijackthis" and "spybot search and destroy" when fixing other peoples computers. It helps if you run the programs in "safe mode". Restart the computer and before you see anything on the screen, press F8 and keep pressing it until you get some text on the screen. Use the arrow key to get to the top selection and press enter.

09-20-2008, 03:21 PM	#9 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,018	Sending PM to you with the 2.4 MB file. My guess is the virus knows of the helpful sites. If it blocks my site too, then it is something else in the virus. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

09-20-2008, 04:25 PM	#10 (permalink)
toydp1224 Registered User Join Date: Sep 2008 Location: wisconsin Posts: 3	i got ride of a trojenn i had by going in to my temperary internet files and deleting every thing i had in there. it was kinda a hassel cuzz my passwords and such werent saved any more but 1000% worth it good luck also if it ses it is still running hit crtl+alt+delete and it will take u to a task menue and u can stop it from there and then delete it in your temp files hope this helps

09-20-2008, 11:19 PM	#11 (permalink)
scuba Registered User Join Date: Jan 2008 Location: WHEELIN BIG BEAR Posts: 6,956	try getting the actual file from someone elses computer, like burn it on a cd or such from theirs, take it to yours and get it done ! __________________ Screw you guys I'm goin to TTORA

09-21-2008, 06:17 AM	#12 (permalink)
ozziesironmanoffroad Registered User Join Date: Sep 2007 Location: Spring Valley, CA Posts: 5,644	try deleting MCAFEE... you'd be surprised what your computer could do. Mcaffee IS the virus... delete mcafee and put AVG on there. or if you have to format the drive, take the ram out for a few minutes, then reload everything. that will clear anything. __________________ The 22r series engines are made from the fires of hell, and will fight tooth and nail to not be sent back. 1988 Toyota P/U 4x4 22re, 1200 miles on the rebuild engine builder .268 cam pioneer CD deck 31x10.50x15 BFG A/T BAJA 100W lights on prerunner bumper KC Daylighters 100W rancho rs5000 MUD IS A VALID PAINT JOB! If not living life to the fullest, why live it? my trucks official buildup thread

09-21-2008, 06:53 AM	#13 (permalink)
swerks Registered User Join Date: Jul 2002 Location: Milwaukee WI Posts: 846	I recieved the stinger It didnt work?? thanks for everyones efforts __________________ 99 SR5 V6 Auto 4WD, deck plate, TRD exhaust, Donahoes/Bilsteins,cornfed spacers, Waag Nerfs, Wet Okole's, Load warrior, Optima red top 86 Turbo SR5 4Runner (work in progress)(Money pit)

09-21-2008, 08:01 AM	#14 (permalink)
woodendude Registered User Join Date: May 2008 Location: Ottawa, On. Posts: 285	Should have also mentioned, if you're running XP turn off system restore run your anti virus apps. then turn system restore back on.

09-21-2008, 08:05 AM	#15 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,018	I mentioned that above. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

09-21-2008, 09:06 AM	#16 (permalink)
swerks Registered User Join Date: Jul 2002 Location: Milwaukee WI Posts: 846	I have turned system restore off. None of my system tools work any way, I cant defrag, or clean up ??? __________________ 99 SR5 V6 Auto 4WD, deck plate, TRD exhaust, Donahoes/Bilsteins,cornfed spacers, Waag Nerfs, Wet Okole's, Load warrior, Optima red top 86 Turbo SR5 4Runner (work in progress)(Money pit)

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Trojan zubox found	Corey	Computer Talk	3	07-28-2005 01:56 PM
I need some serious Trojan help...please	AgRunner06	Computer Talk	16	06-17-2005 06:37 AM
Help with Win32 mersting B Trojan	HOJU	Computer Talk	6	03-10-2005 02:37 PM
Help: Downloader.Lamedon.B Trojan!	AgRunner06	Off Topic Talk	4	05-28-2004 08:22 PM
Trojan Commercials	midiwall	Off Topic Talk	5	01-19-2004 05:32 AM

09-30-2008, 07:02 AM	#17 (permalink)
swerks Registered User Join Date: Jul 2002 Location: Milwaukee WI Posts: 846	Well, I am back up and running, had to completely reformat and reload O.S. lost some info,but like having a new computer again! __________________ 99 SR5 V6 Auto 4WD, deck plate, TRD exhaust, Donahoes/Bilsteins,cornfed spacers, Waag Nerfs, Wet Okole's, Load warrior, Optima red top 86 Turbo SR5 4Runner (work in progress)(Money pit)

09-30-2008, 07:36 AM	#18 (permalink)
*Corey* Co-Founder/Administrator Staff Join Date: May 2002 Location: Auburn, Washington Posts: 26,018	Cool... Get all of your Windows updates done, get a good virus scanner, and a spyware one too. Set the virus app to auto download and apply the DAT files. Most scanners update their DAT files daily. This should help, and nothing like a freshly formatted disc. __________________ Corey 2007 FJ Cruiser Built for 4wheelin', expedition, camping, and overlanding use PNW FJ Cruisers ☺ Detailing 101 ☺ Join Topsites ☺ Muffler Comparisons ☺ Maggiolinas In The Wild FJ Cruiser Buildup ☺ New Roof Top Tent ☺ Video Of My Penthouse Part II ☺ Rehinge Your ARB/Engel Fridge Blog About Roof Top Tents ☺ FJC Magazines Online Review Of My Tent ☺ 2009 Specialized Rockhopper Pro

10-12-2008, 08:04 AM	#19 (permalink)
js9924 Registered User Join Date: Feb 2007 Location: Tampa, Fl Posts: 183	try this click on your start menu and then run. Type msconfig in the window that opens then enter. when the window opens select the option that says diagnostic startup. Click apply and then restart this will only load the basic services you need to run windows xp (which is what I assume you have). If you feel up to it you can click on the tab that says startup and look for anything that shouldnt be there. meaning some software you didnt install yourself. Simply uncheck the box next to it and click apply. Then when you are rebooted try to run the anti-virus/spyware software. This should not allow the virus program to start with windows and will be easier to remove. Of course you can do what I do and create an unattended install and just reinstall the OS. Just google a thing called "nlite" without the quotes. Remember to back up your bookmarks and saved game files though. Good luck __________________ '94 T100 3.0 My mods page: http://www.angelfire.com/fl4/dmb