skip to main content

Trojan Horse

17 years ago

When Norton scanned my computer today it found 4 trojan Horse virus and some tracking cookies,and said it could not get rid of the trojan horses. What can I do to get rid of these bad horses?? Thanks so much. Charlene

Sort by:Oldest

Comments (16)

zep516
17 years ago
Where is norton finding it, we need the filename & path.
zep516
17 years ago
Something like below---a file name and a path to its location.

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
Related Discussions
? about photobucket and claim of new trojan horse
Q
Comments (19)
no no you do not clean anything with hijack this you must go to the landzdown forum that was listed and start a thread there in the hijackthis area then post your results from hijack this there in your post, also tell them everything you have done they will come and help you with step by step directions, the hijackthis produces a log file that is what you need to post there for them to review so they know what steps to take, the team there is one of the best on the net so be assured they will help you but it takes time it is not a one deal cure all it is a step by step proceedure. Just tell Corrine that I and Zep sent you there and you can also link back to this thread here so they can see this info. There have been many with that infection recently and they are able to be cleaned. go here register at the forum and post your thread in this area HijackThis Logs
...See More
question about trojan horse, etc
Q
Comments (5)
no a system restore will not always help you in those cases. You need to go do an online scan and you need to make sure your antivirus program is running full time and fully updated, you want to catch them before they install on your computer. Here is the link to a couple of good online scanners you should go do both of them. It is also possible that the trojan is in your system restore points, you may have to purge them to make certain it is gone. trendmicro scan malware scanner If you do not have a good antispyware program on your pc you can get superantispyware free, you download it update it then run a full scan, you should open it and do that at least once a week, always update all programs before doing scans so they have the latest definitions. superantispyware the one in blue is the free edition.
...See More
Trojan Horse results
Q
Comments (4)
why don't you try running an online scanner and see what results you get, that is not showing us the names or the file paths. Try this online scanner. FREE Online Virus Scan you will need to use Internet Explorer as your browser to run that scan.
...See More
how to remove trojan horse agent.4.E?
Q
Comments (9)
The first time I ran the scan I had 48 infected files. Below are the results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 12:35:40 AM mbam-log-2008-10-31 (00-35-40).txt Scan type: Full Scan (C:\:) Objects scanned: 102474 Time elapsed: 2 hour(s), 39 minute(s), 50 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 38 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 10 Memory Processes Infected: C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"e4e3e0f8-cd30-4380-8ce9-b96904bdefca> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"fe8a736f-4124-4d9c-b4b1-3b12381efabe> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\"c9c5deaf-0a1f-4660-8279-9edfad6fefe1> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"1d4db7d2-6ec9-47a3-bd87-1e41684e07bb> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFinding (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WServing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\macidwe (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfs (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdxdowkc (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Outlook Express\wab.exe.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore"86FA0783-B9F2-4690-B09B-2E6C03E185B4>\RP113\A0017080.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\afisicx.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\noytcyr.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\roytctm.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\tdydowkc.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\wsldoekd.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully. /////////////////////////////////////////////////// So I quarantined them and re-booted and ran the scan again and it showed nothing infected but the same message window that said Resident Sheild Alert Threat name: Trojan Horse Agent.4.E was there above the results of the scan. Below is the logged in results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 1:34:54 PM mbam-log-2008-10-31 (13-34-54).txt Scan type: Full Scan (C:\:) Objects scanned: 102262 Time elapsed: 2 hour(s), 38 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Maybe this is the end of it. Maybe. Thanks so much.
...See More
ravencajun Zone 8b TX
17 years ago
Malwarebytes' Anti-Malware

download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.

try running the malwarebytes scan.
roseluver
Original Author
17 years ago
I ran Malwarebytes and Superantivirus, neither detected it.
Will get back with the file name and path, if I can.
Thanks
zep516
17 years ago
Those 2 programs are good but they do not detect everything if your good with the computer we can have you run (sdfix) from bleeping computer (self help guide) the program is specifically written for this type of infection, please see the link below scroll down to sdfix for instructions. Read the entire page please.

Really would like to see file & path first.

Here is a link that might be useful: sdfix
roseluver
Original Author
17 years ago
Can you tell me how to find the file and path of the virus?
Thanks
Charlene
zep516
17 years ago
Open up the norton anti virus program and look for Reports & Statistics or something like that..

What version of norton are you using the name of norton 360 or what?
roseluver
Original Author
17 years ago
I guess ya'll think I am a real dummy, all I see is Norton from Symantec, it is current. I checked everywhere and could not find a number for it.

I checked Reports & Statistics all I am being told is
Trojan Horse, nothing else. Norton also tells me "removal failed". The tracking cookies were removed.
Thanks
Charlene
zep516
17 years ago
No one thinks you're a dummy, I would visit the forum below, please follow the instructions for posting a hijackthis log you will need to join the forum to do this and they will be very helpful for you. See the link below and let us know the outcome.

zep

Here is a link that might be useful: Spyware help
zep516
17 years ago
I see you have not followed through by posting to the forum suggested, did you seek other help? Running a computer with unknown Trojans is not smart.

Some Trojans make it a point to steal passwords, login information and credit card information, don't put yourself at risk and if you do on line purchasing you're at risk.
roseluver
Original Author
17 years ago
Trojan Horse update. I paid Norton $99 to remove my viruses. Today, when Norton ran a scan it shows I still have 2 Trojan Horses and my computer is acting the same way it did. I am very disgusted. It took him over three hours running my computer to delete the ones he did. AND He deleted all my cookies. I am having to imput passwords every time I go to any forum, for some reason they are not staying, this is very annoying. I have emailed them and have not received a response. Grrrrr!!! Charlene
ravencajun Zone 8b TX
17 years ago
Charlene let me suggest you go to this help forum where we can help you run some more in depth programs and get your pc clean for you, Please go here, register and post in the area I give you, ask Corrine for help tell her I sent you and in your post tell everything that has been found, everything you have done and list all your system info and malware programs you currently have on your pc, you will have an excellent team help you get to work on this and no one is going to charge you a thing.
HijackThis Logs
roseluver
Original Author
17 years ago
I have registered and waiting for a link from them. Thanks
Charlene
roseluver
Original Author
17 years ago
I have registered and posted and waiting for help. Thanks so much.
zep516
17 years ago
In the mean time take a look at the hijackthis part of that forum to get an idea of what takes place there, the first thing you will be asked to do is to download hijack this and post the log in a reply.
ravencajun Zone 8b TX
17 years ago
you posted in the wrong area to get assistance go back and post in the area I linked to which is the hijackthis area.

in the post tell them what programs you have run so far and what has been found and cleaned or removed or put in chest. They will need a lot more info including what you windows version is etc. The more you give them to work with the faster it will go.

Related Stories

HOUZZ TOURS Houzz Tour: A Texas Home Gets a Healthy, Fresh Start

By Mitchell Parker

Mold eradication was just the beginning for this Austin family's home on a creek bed — toxins of all kinds now don't make it past the door

FUN HOUZZ Screen Style Forecast: When the 'Girls' Grow Up

We predict which decorating styles the girls on HBO's new series will choose when their taste matures. Do any match yours?

HOUZZ TOURS My Houzz: An ‘Olde’ Blacksmith’s Cottage Lives On in Style

By Tamara Armstrong

A chic renovation transforms this 19th-century mountain cottage from dark and dank to light and delightful

Sponsored

Kuhns Contracting, Inc.

26 Reviews

Central Ohio's Trusted Home Remodeler Specializing in Kitchens & Baths

More Discussions

Tired of MS Office 365 Monthly Fees?

1