Trojan Attack on Windows

Forums › Microsoft Windows › Trojan Attack on Windows - Help!!

Jono

73 posts

Master Geek

#10740 8-Dec-2006 11:39

Hey guys.

Im not an computer expert so bear with me.

I have Windows XP and currently use AVG Virus Protection aswell as Norton (Which expired 1 month ago). I also use the internet protection part of Norton aswell as ZoneAlarm.

Recently my computer got a Trojan and my anti virus software picks it up.
Its object name is: C:WINDOWS/TEMP/win2c.tmp

I move it to the Vault but another appears.

What are my best options to get rid of it.

Often i get pop ups for "Spyware remover" or porn sites.

My computer is a new Compaq Presario V3000.

It cam with the Norton Anti Virus and Windows.

Any help would be much appreciated.

1 | 2

19282 posts

Uber Geek
Inactive user

#54980 8-Dec-2006 11:56

remove AVG and Norton and run avast antivirus

and stay of dodgy web sites!!

Might require a reinstall of windows

www.avast.com and then free download

freitasm

BDFL - Memuneh
79289 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#54982 8-Dec-2006 12:04

Depending on the trojan it may be hard to remove - some modify Windows in such a way that removing it may break other things.

The best software for this:

- Avast AV (free for home use): www.avast.com
- Windows Defender (free): www.microsoft.com/spyware

As pointed out by johnr, if the thing is too bad then you might need to reinstall Windows.

Jono

73 posts

Master Geek

#54985 8-Dec-2006 12:38

Cool thankz guys.

ill give it a go and keep you updated.

Jono

73 posts

Master Geek

#55006 8-Dec-2006 15:19

Ok ive done all of the mentioned but Avast still seems to be picking it up even after ive had them removed, also with the help of Windows Defender.

I dont mind if i have to wipe everything off as ive backed all of the valuable stuff up and the majority of the programs i can re download.

Would re-installing windows solve the problem?

My computer can pre-loaded with Windows XP and i dont have the CD.
Also how to i go about doing it?
Ive got the computer Recovery CD's.

Any help would be great.

johnr

19282 posts

Uber Geek
Inactive user

#55009 8-Dec-2006 15:37

reinstall windows

cokemaster

Exited
4929 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#55010 8-Dec-2006 15:40

If the computer did not come with any Windows CD's there are two possible options.

A. There is a partition on your harddrive with the windows bits and pieces.

B. Your recovery CD/DVD has the windows stuff on it.

If A, you should see something like 'Press F10 to start system recovery' or something similar when you first turn your computer on. If you go through this, it will restore an image of Windows + drivers that have come with your computer.

If B, you should be able to insert it into your computer and then turn it on... it should load automatically or have a prompt.

Some of these recovery CD's give you the option of keeping the existing partition and its files intact, which is useful if you don't really feel like backing up/restoring all your documents. While this may be a useful feature, I would not rely on it as it may delete your files and also you may have 'dirty' (spy ware/viruses) files left from the previous install. Backing up all the files you need (most usually residing in My Documents) is the cleanest approach.

webhosting

Loose lips may sink ships - Be smart - Don't post internal/commercially sensitive or confidential information!

Tarq57

156 posts

Master Geek

#55017 8-Dec-2006 16:13

Had a look at that virus name on google, no information. Sure you've posted the name of the beast correctly? Also, confirm which AV program detected it? (You say you have Norton and AVG running. Did you completely uninstall Norton AV or security suite before installing AVG?)

Everyone here so far seems awfully keen to reinstall the OS.

If you want to fix it without reinstalling, and learn a bit about pc's at the same time, take a look here :http://wiki.castlecops.com/MRP
Read the info, click on the blue link near the bottom of the page. Warning: (From one who has done this) It will take about 2 hours, and you'll need to download quite a few applications, including AVG antispyware, maybe HijackThis, and a few others.

Make sure the pc is in good order first though by downloading http://www.ccleaner.com/ and cleaning everything up. This cleans temp files, and a whole heap more. Suggest you read the tutorial/help files first. The forums are also helpful, and there is a dedicated security section. People who are a darned sight more qualified than me browse and help frequently. Definitely worth a look.

Anyway, just a few ideas there for you to ponder on. If you've already reinstalled, and all is working well, I would suggest turning off system restore, rebooting into safe mode, and carrying out a full virus and antispyware scan. Clean anything that's found. Reboot, turn system restore on, create a new restore point.

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

barf

643 posts

Ultimate Geek

#55019 8-Dec-2006 16:19

Just thought I'd add my suggestions here;
I'd vouch for the suggestion to reinstall. Once spyware/adware/whatever sinks it's teeth into Windows it's 9/10 times uneconomical to repair the OS recovery disks bring the system back to it's fresh-out-of-the-box state.

Do not run more than one antivirus at a time!

Stay clear of Norton Internet Security - the default XP firewall is 10 times better.

Sniffing the glue holding the Internet together

bradstewart

4335 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#55021 8-Dec-2006 16:39

I have to agree that a full reinstall is the best option.

Also be careful of what you back up, you dont want to restore a virus back on to your nice clean system.

As for decent AV programs, I would recommend either Trend Micro PC-Cillin or Microsofts OneCare. Both very very good.

Jono

73 posts

Master Geek

#55022 8-Dec-2006 16:49

Tarq57: Had a look at that virus name on google, no information. Sure you've posted the name of the beast correctly? Also, confirm which AV program detected it? (You say you have Norton and AVG running. Did you completely uninstall Norton AV or security suite before installing AVG?)

Everyone here so far seems awfully keen to reinstall the OS.

If you want to fix it without reinstalling, and learn a bit about pc's at the same time, take a look here :http://wiki.castlecops.com/MRP
Read the info, click on the blue link near the bottom of the page. Warning: (From one who has done this) It will take about 2 hours, and you'll need to download quite a few applications, including AVG antispyware, maybe HijackThis, and a few others.

Make sure the pc is in good order first though by downloading http://www.ccleaner.com/ and cleaning everything up. This cleans temp files, and a whole heap more. Suggest you read the tutorial/help files first. The forums are also helpful, and there is a dedicated security section. People who are a darned sight more qualified than me browse and help frequently. Definitely worth a look.

Anyway, just a few ideas there for you to ponder on. If you've already reinstalled, and all is working well, I would suggest turning off system restore, rebooting into safe mode, and carrying out a full virus and antispyware scan. Clean anything that's found. Reboot, turn system restore on, create a new restore point.

Yep i removed Norton.

I keep getting this pop up bubble saying that my computer is "probably infected with with the latest version of Spyware.Cyberlog-x" and then directs me to some sofware site such as pesttrap.

This is the name of the Malware that Avast picked up: Win32:Dialer-759 [Trj]
Malware Type: Dialer
VPS Version: 0654-1, 12/07/2006

Cheers

Tarq57

156 posts

Master Geek

#55030 8-Dec-2006 17:54

Ok, that is a trojan, it will be accessing the internet on it's own, unless you have a two way firewall, and/or a hardware firewall set up and correctly configured. It is also, from accounts I've read, a bit tricky to eradicate. If you feel like having a go, the link I posted will steer you in the right direction, but you might well want to consider reinstalling, to be sure. Once a trojan infestation is under way, it calls on it's nasty friends, and sometimes they come and "join the party", so to speak. So I do support reinstalling, if you're in any doubt.
Having done that (or eradicated it by other means, which will be an interesting and time involving project) I would advise getting a good 2 way firewall to replace the built in XP firewall. XP's is good, but it only blocks inbound.
I'm using Comodo firewall, which has scored very well on leaktests. And it's free. Good idea also to have a resident antispy program, such as Windows Defender, AVG antispyware, or SpywareTerminator. (AVG is a 30 day free trial, then it reverts to an on-demand scanner. The other two are free. There are some good pay alternatives too, of course.)
Avast is a good antivirus. The higher rated pay antiviruses include NOD32 and Kaspersky.
Good luck.

barf

643 posts

Ultimate Geek

#55032 8-Dec-2006 18:03

Tarq57: I would advise getting a good 2 way firewall to replace the built in XP firewall. XP's is good, but it only blocks inbound.

I'm pretty sure the XP firewall can block outbound connections and prompts the user to Allow or Block when a new app attempts to connect to the Internet. Does it not?

Sniffing the glue holding the Internet together

bradstewart

4335 posts

Uber Geek

Retired Mod

Trusted

Lifetime subscriber

#55035 8-Dec-2006 18:11

IIRC it does.

freitasm

BDFL - Memuneh
79289 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#55039 8-Dec-2006 18:53

It does, but it's not the best thing in the world. The built-in firewall on Windows Vista is much better, with full control.

Once a PC is compromised I suggest reinstalling.

Tarq57

156 posts

Master Geek

#55048 8-Dec-2006 19:59

Nope. Don't think so. http://windowsxp.mvps.org/firewall.htm#xplimitation, http://www.auditmypc.com/free-firewalls.asp (3rd para) http://www.brienposey.com/kb/windows_xp_firewall.asp (last para) http://support.microsoft.com/kb/875357 (note below last screenshot) http://www.mdgx.com/xp2.htm, http://www.matousec.com/projects/windows-personal-firewall-analysis/leak-tests-results.php.
Appears XP (sp2) firewall has limited rules based protection for outbound, is not configurable, and is an excellent firewall, IF you don't have/will never get malware on your system.

1 | 2