Trojan horse remnants!! Can anyone help?

16 years ago

My computer caught a trojan horse about 3 weeks ago. It was terrible. My friend took my computer and fixed it. There is still a problem that continues now. It's when I'm trying to search for something. If I type in a word or phrase and search it, then you get a list of websites. If I click on the website's title, as I usually do, another window opens up and I am redirected to another website. Sometimes I can go back and copy and paste the actual website, but not always. To make it worse, if I google "having problem with browser redirecting" or something like that to find a solution, and click on an article or something, it immediatley starts downloading that trojan horse, which my new firewall catches. So I can't even search for answers and each time I have to scan my computer to get rid of it. Now it's doing it when I click on a thread here at the garden web, too.

I emailed my friend about the problem, but I feel bad always calling him when I have problems. I have no idea what else to do!! Does anyone know how I can fix the problem? Secondly, what do you do when you have such problems? We used to use the geek squad at Best Buy but they are really terrible anymore.

Sort by:Oldest

Comments (10)

ravencajun Zone 8b TX
16 years ago
yes you need to go to this security help forum, register, post a thread in the area I list and post this same info there, the team will help you. You will need to run some special programs that must be run with the assistance of one of the security pros.
Analysis and Malware Removal

Tell Corrine I sent you, I will look for your post there. if you need help doing that just let me know.
owbist
16 years ago
Secondly, what do you do when you have such problems?

You come to places like this one as you have just done.

Be prepared to give as much detail as possible and be willing to follow along with instructions. Always read the instructions one line at a time rather than look at the whole thing and feel overwhelmed. If you get overwhelmed hit the Cancel button and walk away till you regain your composure and start again.
Related Discussions
Trojan HOrse Downloader Generic 10.CEAB
Q
Comments (4)
Duh...Wasn't thinking at all....32 bit system! When I went to the link, my first thought was, should I even attempt this? Anyway, back to the link.
...See More
Trojan horse Rootkit CW uh oh
Q
Comments (35)
This is the second Malwarebytes scan after I removed everything I could from the first scan results. Malwarebytes' Anti-Malware 1.35 Database version: 1939 Windows 5.1.2600 Service Pack 3 04/03/2009 11:04:36 PM mbam-log-2009-04-03 (23-04-36).txt Scan type: Full Scan (C:\:) Objects scanned: 119355 Time elapsed: 47 minute(s), 4 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 15 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 8 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP997\A0179839.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\acpi32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\amd64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\nicsk32.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\fips32cup.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\i386si.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
...See More
question about trojan horse, etc
Q
Comments (5)
no a system restore will not always help you in those cases. You need to go do an online scan and you need to make sure your antivirus program is running full time and fully updated, you want to catch them before they install on your computer. Here is the link to a couple of good online scanners you should go do both of them. It is also possible that the trojan is in your system restore points, you may have to purge them to make certain it is gone. trendmicro scan malware scanner If you do not have a good antispyware program on your pc you can get superantispyware free, you download it update it then run a full scan, you should open it and do that at least once a week, always update all programs before doing scans so they have the latest definitions. superantispyware the one in blue is the free edition.
...See More
Desperate-have trojan and can't even boot from disk to wipe HD
Q
Comments (3)
Your post reminds me how out of touch I have become with this kind of problem (and I am just posting about a possible win install too). However like you, I remember some things from my past and I suspect that your problem is probably a simple fix. At least for the time being, I think reinstalling windows is extreme and since you have a second working computer you should wait for some of these other clever folks to help. I'll bet there is some utility to help with this but if not, there must be a way to mnually link particular extensions to specific programs, and for the time being you would probably only need to make a couple of links (but don't ask me how).
...See More
bigbaby
Original Author
16 years ago
Okay Raven, I went to the link you posted and registered. I'm waiting for an email from them.
kudzu9
16 years ago
You probably don't have a remnant, you've got the whole thing. I had one like this a couple of weeks ago and it was very persistent. My McAfee caught part of it, but what got through was able to replicate like a zombie coming back from the dead. I finally completely cleared it out by running Malwarebytes, then Spybot, then SuperAntispyware...all free programs. By the way, when you click on a link and it redirects, you may be able to see what the rogue site is by looking at the bottom of the screen: it should flash the name in the task bar for a fraction of a second. Mine was something called "thefeedyard.com" which was registered to some Russian hacker.
bigbaby
Original Author
16 years ago
Thanks Kudzu. At the moment I'm completely swamped so I'll probably have to wait until Saturday to try to do any of this stuff. Some of the suggestions I've gotten have been very complicated! I'll have to wait until I have enough time to focus on it all.
ravencajun Zone 8b TX
16 years ago
very very rarely do we get them fully clean using the mentioned programs, they do an excellent job to get it removed enough to be able to work with it and finish the job. Just follow my link and do post at LzD the team there will assist you, I can start a thread there for you if you prefer just let me know.
It is likely you will need to use combofix with guidance and specific to your machine.

I think many would be very surprised to find just how much remnant remains even when it seems to be back to normal. Which is why when one of the bad ones hits it is imperative to go to the security help forums and let the pros help. Looking at logs and in depth examination is essential.
Unfortunately it is not something everyone is willing to do, it is time consuming and very detailed.
The most important thing though is once you do get help from a forum like LzD it is imperative to stick with that forum and that team till they tell you it is all done. Following different suggestions on various places confuses the issue and is not fair to the helpers.
bigbaby
Original Author
16 years ago
Okay Ravencajun. It's Sunday morning, I have a strong cup of coffee and I think I'm ready to try to tackle this problem! I've logged onto LzD and I should just start by posting my question, right? Here goes!!
bigbaby
Original Author
16 years ago
Ravencajun, I'm going through the "Log Posting Instructions" now so I'm not posting a new thread yet. I don't want you to waste your time looking for a thread when it's not there yet!!
ravencajun Zone 8b TX
16 years ago
it is ok just go ahead and post there you can actually also put a link to your thread here so we can keep it all together and avoid confusion. If you need me to help you post just let me know.
bigbaby
Original Author
16 years ago
Here is the link to the LzD site.

Here is a link that might be useful: LandzDown Link

Trojan horse remnants!! Can anyone help?

Comments (10)

ravencajun Zone 8b TX

owbist

Related Discussions

bigbaby
Original Author

kudzu9

bigbaby
Original Author

ravencajun Zone 8b TX

bigbaby
Original Author

bigbaby
Original Author

ravencajun Zone 8b TX

bigbaby
Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Trojan horse remnants!! Can anyone help?

Comments (10)

ravencajun Zone 8b TX

owbist

Related Discussions

bigbabyOriginal Author

kudzu9

bigbabyOriginal Author

ravencajun Zone 8b TX

bigbabyOriginal Author

bigbabyOriginal Author

ravencajun Zone 8b TX

bigbabyOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

bigbaby
Original Author

bigbaby
Original Author

bigbaby
Original Author

bigbaby
Original Author

bigbaby
Original Author