st.exe. Trojan..

I've been looking around these forums and found about 2 posts about this thing... Im a begginer to this stuff, Norton keeps telling me I have this everytime i open my WINDOWS folder. and that it cannot delete it.. it once did but it came right back. I dont know what to do. I found it today in my windows folder and i tried to look at the properties, and what in the world was it, but the norton warning kept coming up! I..

*Ran disk cleanup
*Deleted Temporary Internet files
*Ran norton
*Cleared recycling bin.

I know its not enough, but i need instructions on how to get rid of this

 

Hi Strawberry, welcome to Wilders, there is a thread here: https://www.wilderssecurity.com/showthread.php?t=50662 that should resolve your problem.

If you are comfortable editing the registry then there is a post here with the same issue https://www.wilderssecurity.com/showthread.php?t=44389

Hope this helps...

Let us know how you go...

Chjeers

 

thanks for your reply, i havent downloaded hijack this, but is it worth it, or does it put anything on your computer

 

If you go through each and every step without missing one, I'm pretty sure you will be able to clean your system.

Hijack This is a tool for experts to see what is going on with your system...

Hope this helps...

Cheers

 

Ill stay away from Hijack This i am not an expert, alright this is what i did so far.

*Ran computer in safe mode
*Downloaded and ran ad-aware
*Down loaded and ran SB
*Emptied Recycling bin
*Deleted Temporary Internet files.
*Downloaded and ran "STINGER" (its still scanning)


whats shellmon.exe?

 

You're doing good, just make sure to run each and every step, and if this fails you will need to download HijackThis and post the log at one of the forums listed in that link, so an expert can help you with it...

Shellmon is part of AOL, more info can be found here: http://www.liutilities.com/products/wintaskspro/processlibrary/shellmon/

Cheers

 

oh ok thanks, i also ran ewdio security suite

 

Have you run Norton in "Safe Mode yet?

Have you run Spybot Search and Destroy?

Have you run AdAware?

These are all very important steps...

Keep going, it is a long but thorough process..

Cheers

 

something is seriously wrong with norton, my gosh. Just a minute ago the virus alert error popped up like maybe um, 70 TIMES? but it when away.

Have you run Norton in "Safe Mode yet? No, I'll do that now...
Have you run Spybot Search and Destroy? yes

Have you run AdAware? Its still scanning. 40 process running, 440 objects found,
..
this is getting me angry! lol but i guess its my fault

 

wait a minute!! how do you run norton in safe mode?!

 

We’ll get you sorted

You will probably have to go to Start> All Programs and click on Symantec/Norton and run a scan from there, it can be done, I just don’t run Norton myself…

Cheers

 

is there anyway to stop the errors?

ad aware scan is done, but i dont think i can stick around for the stinger, and ewdio scan that has been scanning for 2 hours, and is only on 51%


heres another error, lets count shall we? Hey only 4 clicks this time.

 

Are you running scans simultaneously?

You should run each step in the order provided, and then move onto the next, and most steps should be run in Safe Mode.

Cheers

 

gr, you mean im not supposed to run them at the same time?

i cancelled the stinger


=(

Shall we try again tomorrow? I didnt do the steps in order, i ran the programs after the safe mode because i forgot to print out the directions!

 

LOL, yes, one step at a time, or you will slow your system to a crawl. We can try this again tomorrow, if I'm not here, someone will be able to help you. I'll ask the Moderators to look out for your postings in this thread...

Cheers

 

Thanks alot

 

hey i tried again today guys, but i didnt use EWIDO, i used TDS. It detected the trojan's folders, i deleted the notebook.com's. Can I delete the TrojanDownloader.Win32.Small.oc, TrojanDownloader.Win32.Small.oc Dropper, ETC?


Is there anyway to unlock a folder?

Thanks =D

 

And my username is Strawberry 2 because i cannot get into my old one for some reason...

 

Yes you can delete those, if it says file locked access denied, it means its in use.

Booting into safe mode can help, as only the necessary processes will run, to do this go to START>RUN>type MSCONFIG>go to boot>put a tick in SAFE>restart, you will now restart in safe mode.

Try running TDS-3 in safe mode, if that does not get rid of them post back.

 

I just got finished running TDS-3 in safe mode.
It detected "Dual Extentions" Python 2.2.1.EXE and st.EXE
I deleted them both, just to be on the safe side, what should i do to make sure it is gone?


Thanks Sweetie(*)(*) and Blackspear!

 

Hi Strawberry and Strawberry2 Just run through each of the steps again, do not go to another step without completing the step you are currently on...

Once you are clean, then we'll need to get your security up to spec so this doesn't happen again.

Let us know how you go.

Cheers

 

Thanks for your help guys, im so stupid!

St.exe wont come back when i start the computer back up, or restart it?

 

by the way,

C:/54f48f5093bb39088ccsd47786/spuninst.exe

..that folder is locked when i do safe mode and normal mode, what IS THAT?!

 

Being that you deleted it, it shouldn't, however it is really important to got through each of those steps, one by one, and the whole process 3 times...

Cheers

 

Not ONE error from norton! and i figured out what the other locked files were, umm the windows service pack files.

When i grow up i wanna be like you guys!!! (SMART)
(im 13)