Looking for some help removing stubborn Trojans

[RKelly]

Ok first I admit it's my own fault, I made a mistake and I learned a valuable lesson about downloading programs from unverifiable places. I downloaded and installed a program I trusted, which I believe changed some system files, and I got some trojans which I now can't seem to get rid of. I have the McAfee suite that comes with Comcast and Windows Defender protecting my system (windows vista), and I cannot seem to get rid of several trojans.

Here's what McAfee Finds:

Generic.dx
Vundo
FakeAlert-BD

Windows Defender Finds Win32/Zlob.gen!CD

These are blocked and removed by the respective programs, but every time I restart vista I get the same messages that it finds them, blocks and removes, etc. I have tried running each program in safe mode as well. But still, every time I start back up I am getting these messages.

I have noticed some unfamiliar websites being brought up, my desktop background was changed, etc. Also, when I try to download an alternative spyware program like avg free, firefox crashes and closes immediately.

I also tried system restore, going back several days before I installed the suspect program. But here’s a message I receive:

“System restore did not complete successfully. Your computer’s system files and settings were not changed. Details: An unspecified error occurred during system restore.”

I'm really kind of stummped at this point. I really don't want to have to reinstall the operating system if possible.

Any suggestions? I really appreciate your input, thanks!

[Epicurus8a]

Try: Spybot - Search and Destroy. You can download it free!

[aedipuss]

there comes a time when you just have to bite the bullet and do a full format of the drive. there are some trojans that replicate themselves many times with different names and hiding places. some of them you just have to burn to the ground to get rid of....

but if you need to try more start here
http://www.bleepingcomputer.com/forums/topic34773.html

consider it a lesson learned. always scan before opening/running anything you download.

mcafee is one of the worst at protecting your computer. even avg free v8 is a better program.

[redwudz]

Spybot is a good program. I also use SpyWare Blaster to keep those type of programs from loading in the first place. I also use Comodo firewall and though it's a bit irritating at times, it's blocked a lot of problems. For anti-virus, Avast. All freeware and Vista compatible. And they work and play well together.

The Vista firewall is about useless as it only blocks incoming files, nothing outgoing, and that lets the trojans 'phone home'. All the time I have had Windows Defender on three Vista computers, it has yet to find or block anything.

One highly recommended anti-malware program is MalwareBytes. It found problems all the other programs missed: http://www.malwarebytes.org/ There is a freeware version available.

It's not uncommon for trojans to load themselves into your restore files and keep returning. Since yours are unusable at present, I would temporarily turn that feature off. Another good method for removal is to boot to 'Safe Mode' to run your anti-malware programs. Most trojans don't load in that mode. One level deeper for removal is HiJackThis: http://www.merijn.org/programs.php#hijackthis It's a bit difficult to use, but very powerful.

One last note about all those programs. Only download them from the original authors page or a reputable page. There are some 'fakes' out there that are disquised as anti-malware but are malware themselves.

Good luck.

[Midzuki]

1) Please drop McAfee --- it's rubbish. Every seriously-skilled malware of today
is designed for fooling both Norton and McAfee, to begin with.

2) Google for "gmer" --- it's very good for unveiling many programs which
manage to be invisible to Windows Explorer, Task Manager and Regedit.

HTH.

[hech54]

Scan and attempt to remove it in SAFE Mode.
Easiest way to SAFE Mode is with BootSafe. It comes bundled with another great program that may be useful to you called SuperAntiSpyware:
http://www.superantispyware.com/

You can also get just BootSafe:
http://www.superadblocker.com/bootsafe.html

[AlanHK]

If you want to run a program but feel the slightest suspicion about its side effects, use Sandboxie from http://www.sandboxie.com/

Original purpose to run IE (thus the name) but you can "sandbox" just about anything, allowing you to use a program without any changes being made to your system.

[RKelly]

thanks for the suggestions everyone, I'll try your ideas and report the results!

[RabidDog]

These are normally introduced to your system if you have tried to copy or rip the DVD "Spartacus...." special edition.

Search for a user name "LEONIDAS", he is brilliant at removing trojans.

[RKelly]

I used the malwarebytes program and ran it in safe mode. It found the trojans and removed them. It seems to have done the trick! Thanks for all the suggestions, the helpful people here are a big reason why I turn to this website for advice.

[fatbloke88]

If you've been infected as good as malwarebytes anti malware is I wouldn't just rely on one program to say your clean.Each different tool generally picks up the odd file that the other misses.
Hech54's suggestion of superantispyware would be worth running as would Asquared antimalware both have free versions.
As midzuki pointed out Mcafee is not that great a detecting viruses so it might be worth while using a few free on line scanning tools like DrWebb and kaspersky

http://www.kaspersky.com/virusscanner
http://www.freedrweb.com/
http://www.emsisoft.com/en/software/free/
http://www.superantispyware.com

[MJA]

I used the malwarebytes program and ran it in safe mode. It found the trojans and removed them. It seems to have done the trick! Thanks for all the suggestions, the helpful people here are a big reason why I turn to this website for advice.

remove McAfee . try NOD32 it is not free but it's worth it.

http://www.newegg.com/product/product.aspx?nm_mc=AFC-TechBargains&cm_mmc=AFC-TechBarga...82E16832114005 it was $14 few weeks ago

[wtsinnc]

It's already been mentioned, but to reiterate; McAfee is substandard and when it comes time to renew- don't ! If you really want to know just how inadequate McAfee is, look over the antivirus tests at AV-Comparatives, Virus.gr, and Virus Bulletin.

In my opinion, I believe you should do the following, none of which will cost money.
-Uninstall McAfee- TODAY !
-Download and install/configure either Avast (free) or Avira (free) antivirus.
-Download, install, and configure either the Zone Alarm, Online Armor, or Sunbelt firewall. The first two are free, the Sunbelt F/W starts as a free trial, then reverts to the free version with several options deactivated. Any will give you excellent protection if properly configured.
-To augment your antivirus program, keep Malwarebytes and add a second opinion application such as A-Squared (free).
-Deactivate Windows Defender. It's detection capability totally sucks and it's ability to effectively deal with the malware it can find also totally sucks.
-In it's place, download/install the free version of Win Patrol for a simple but effective HIPS as well as a comprehensive start-up manager and cookie control.
-Use the Firefox web browser with added options NoScript, Flashblock, and AdBlock.

All of the above programs are totally free, have excellent track records, and are compatible not only with each other, but run fine on 32 bit Vista. I have found downloads from www.filehippo.com, www.fileforum.com, and www.softpedia.com to be spam-free and no registration is required.

[isogonic]

ok so now that you are all cleaned up, heres my top ten list on preventing malware in the first place. should help to lessen the risk anyway:

1) Keep your OS, (Windows) browser (IE, FireFox) and other software up to date.
2) Know what you are installing to your computer. Alot of software can come bundled with unwanted add-ons.
3) Install and keep them all updated: one antivirus and two or three anti-malware applications.
4) Refrain from clicking on links or installing files you receive via E-Mail, IM, Chat Rooms or Social Sites, no matter how tempting or legitimate the message may seem.
5) Don't click on ads/pop ups or offers from websites requesting that you install software to your computer.
6) Don't click on offers to "scan" your computer.
7) Set up and use limited accounts for everyday use, rather than administrator accounts.
8 Install and understand the limitations of a third party software firewall.
9) Consider using an alternate browser and E-mail client.
10) If your habits include visiting or downloading/installing files from: warez, crack sites or p2p (file sharing) networks: then you are much more likely to encounter malicious code. Do you trust the source?

[SCDVD]

If your habits include visiting or downloading/installing files from: warez, crack sites or p2p (file sharing) networks: then you are much more likely to encounter malicious code. Do you trust the source?

If you do this even occasionally, it's 100 percent likely that you will get burned.