New Here - Computer Idiot - Have Trojan - Cant get rid of - HELP, pleeze

hi - i found this site doing a trojan horse virus search. i've read several of the posts concerning this, but i'm just not computer-smart enough to understand it all or to know if what is said will help me, so i'm going to post my situation here and perhaps you experts here can just direct me to relevant posts thanks so much!

i am using windows XP - i dont know the last time i upgraded it, but i usually do it whenever i'm told there is an upgrade.

i have the free AVG virus scan program. i also use spybot and ad-aware.

a big ugly guy pops up on our screen from AVG telling us its detected a virus. on that screen, it calls it 'trojan horse downloader.agent.11.Q'. i run and rerun AVG to clear it, but i'm just not happy about how it tells me it fixed it esp when i keep getting these pop-up ads that i never got before. the last time i ran AVG, it said it detected 'java/byte verify'. like i said, i'm not computer-smart enough to understand this.

i read here about deleting java - i dont even know what java is (altho i do know we went to a site tonight that used java.....) - and i went to my control panel but i dont see where java plugin is, so i've already hit a dead-end on that job.

also, i was given two different websites that will scan my computer for free - one was house call, i believe - but this virus shuts down any site that has trojan in it, i think, cuz i cant get any of these sites to run and scan my system.

is that enough information? can i be helped?

 

Hi KathyL & welcome

You can download java from here, it's auto download and it will check if you the latest java or not. When trying the free online scanners (links to them in my signature) you need to allow activeX (they will ask for it), they all need this to to install/scan.

If you are still not able to use the online scanners then post back, or you could try to install (uninstall AVG first!!!) Kaspersky anti virus trial, it has a very large signature database (much bigger than AVG) and generally known as the best allround anti-malware detector (you can always uninstall it after you are clean) ,if you do this, do it this way:

https://www.wilderssecurity.com/showpost.php?p=429603&postcount=3, the only difference being that under "configure updater" you should use "standard bases".

Post back, if you have questions.

 

Hi you have a memory resident Trojan, see HERE .

My reccommendations for removal;

Download and install the free beta of NOD32 (uninstall any other Antivirus first)

Turn off system restore

boot into safe mode

run the clean function of nod32


if you need help with any of these please post back, Nod32 antivirus has some advanced options that could be a help, if after running the first scan it does not remove the threat we can configure more options.

 

went to the Java page and it said it encountered an 'issue' while trying to install Java on my computer, so strike one against me...

will uninstall AVG (deactivate or whatever) and try the next step...

 

ok, just uninstalled AVG and rebooted. last night after i'd rebooted, i got the same kind of error i just got now, and i recognize these files and files AVG deleted last night because they were infected by the Trojan Horse Dowloader.Agent 11.Q...

but last night, i was told system could not find: c:\windows\apiym.exe

today i get that it cant find: c:\windows\system32\d32d32.exe and d3uw32.exe

i'm continuing on...

 

Dear Kathy, you are running XP have you tried doing a system restore to a point before you were having problems? Assuming you have restore enabled. But it has to be restored to a point before you were having problems because its likely the trojan is also in your latterly restore volumes.
Ah I have just seen Sweetie asked you to switch off system restore which means all your restore points will all be lost, if you have done so.
Gordon

 

Uninstall AVG through Add/remove programs in the controlpanel, then do this: https://www.wilderssecurity.com/showpost.php?p=429603&postcount=3

You can manually download java here:http://www.java.com/en/download/manual.jsp, choose the "Windows (Offline Installation)" install it as you would normally do when installing a program.

 

gordon - i've not done what sweetie has suggested. working on the one above her right now - uninstalled AVG, installed Kaspersky and now just waiting for DS to be finished online on our 2nd computer so i can do the scan in safe mode offline.

this kaspersky scanned /wo my knowledge, however. just as it started running, i got a op-up that apears out of my task bar saying my virus scanner is VERY is (it is updated every day, so i'm sure this is the trojan talking) and i couldnt get that dumb window to close. i clicked on another window and nothing would close! after a time, another window would open (like i clicked 'start' and my start window came up but wouldnt close!!! right beside that is another i've never seen before that is still there - cant figure out how to make it go away. it says 'transfer now; preferences; help; about... [and its moved down now so i cant see all of the window but i know it said something about it being safe to use the F drive or something like that... MY POOR COMPUTER!!]) so i went away from my computer for a time to see if the windows would eventually close and the Kaspersky scanner had evidently started scanning cuz its window was up saying it had found an infected object and suggested to delete it. when i chose the option to delete it, i was told access was denied and i could not delete it. the three files are: addih32.exe, addih32.exe and atluy32.dll.

now, please talk to this computer-not-so-smart person about system restore. i'm guessing this virus showed up friday evening sometime. what happens if i restore (and HOW do i restore?)? i mean, do i lose everything entered after that time (chosen for restore)? for instance, i've taken and loaded pictures on my computer probably after this infection - if i restore, will i lose those? (please say no; please say no; please say no...!)

thanks again.

 

still havent been able to shut down computer and run in safe mode. in the meantime, i cannot close the kaspersky window. and i just got that stupid pop-up window that said my virus scanner is VERY old... but it closed all by itself this time... that stupid pop-up window ('transfer now, preferences, help, about...") is still sitting here.

ok! DS is off the computer! so disconnecting from internet (we have cable) and will check in safe mode.

 

KathyL,

You mentioned that you did as Sweetie suggested. If so, turning off system restore means there will be no restore points remaining. This isn't a major deal and Sweetie's advice is correct on this count. If you haven't turned off system restore, you probably have a restore point before Friday. Restoring to that state effects installed applications and the like. If your pictures are stored in a standard location under My Documents, they won't be touched. A restore operation doesn't muck with user data.

The current version of Kaspersky always does a start-up scan. As I recall before I adjusted things (and this may be different now), the start-up scan was a comprehensive one, that's probably why a scan is progressing, and that's not a bad thing.


Those files you mention should be in the C:\WINDOWS, C:\WINDOWS\SYSTEM, C:\WINDOWS\SYSTEM32 folders. Delete them in safe mode. If you can't delete, try to rename them, that actually works in many cases. Also, get yourself a copy of Process Explorer. It's free and can be useful for diagnosing problems and doing simple process kills.

Blue

 

To disable system Restore: On your keybord press the "start button" hold it and press the "pause button" also on the keybord, now a window should appear, choose the "system restore tab", check "turn of system restore" and click "apply", now it's turned of.

You need to update Kaspersky, that why it says "database is very old", but before doing that, do this: Leftclick on the red "K" in the tray/task bar a kaspersky window appears choose the "settings tab", In settings: choose "Configure on-demand scan" push the slider to max protection and select "perform recommended action", under "configure updater" select this:

http://img85.echo.cx/img85/2668/kav50configureupdater0zw.jpg

Now right click on the red "K" in the task bar and choose "update anti-virus database". Reboot (or turn of the computer a & start up again, use the powerbutton if it won't).

Now do a scan in safemode, when in safemode click start > All Programs > choose Kaspersky > in the window choose scan my computer.

Post back with results.

 

i'm feeling way over my head right now...

1 - i have not done what Sweet suggested. i believe its Don who suggested downloading Kaspersky and scanning and i am still trying to do this. i managed to get computer off-line and get in to safe mode then forgot i'd not updated Kaspersky, so had to undo all i'd done and do that. finally got in to safe mode, ran kasper and it only scanned one file!!! why is that?

2 - and when i was switching back from safe mode to standard (or whatever its called), i got this window message - "you are currently set in diagnostic or selective start-up mode..." while switching back and forth between safe and regular mode, i see where it IS clicked to start-up in diagnostic, but i did not click that. i only looked for the page/window that gave me the option to start-up in Safe Mode. so what do i do about this?

for the last 2 posters, i've not really read or applied what you've said as i'm stuck on my very first assignment; scanning my system using Kasper. i so appreciate what is being said here and i hope you wont give up on me as i'm sure my computer is in big mess shape and i so need help to get it back!!! thank you thank you thank you!!

i have to go run some errands, so i'll be gone for a while... hopefully, lots of help will come my way.

 

kathyl,

No worries, we're in here for the long haul - and that means a working PC on your end. We'll slow to a pace that you're comfortable with, and it may take a few iterations to get that right. Time to step back and take a breath. I also have to pop off for some errands. Be back in a bit.

Blue

 

oh, boo hoo. i'm back (and exhausted!) but no one has posted....

does 2+ hrs of grocery shopping count as cardio

 

Hi Kathy,

The Pros will be back shortly. In the meantime, maybe you can tell us where you are at at this time. E.g. are you sitting in Safe Mode with an up-to-date KAV? Don't do anything more until the Pros get back - just maybe a statement of where you are at.

Rich

 

thanks, rich!

i've left safe mode as i came back online to Wilders to see if anyone knew what i needed to do w/Kasper (sorry for abbreviation!) to have it scan my whole computer and not just one file. kasper is up-to-date. i did just run another scan and it said it found and deleted 10 files.

as a side note, i did just get a message that i have a private message and to click 'here' to view it in another screen, but browser (IE) could not open another browser (perhaps because of a pop-up blocker, it suggested).

so now off to find my private msg...

 

Hi KathyL,

Sounds good. Don't do too much until you get some more step-by-step advice. These kinds of things can be fixed, but doing too much, too soon, sometimes overcomplicates things.

Did you look at the report that KAV provides and make note of the files and malware that it deleted (quarantined)? This might be helpful to know. KAV is very good at cleaning things up, but more may be needed, depending upon the report. Sometimes, for example, KAV is unable to delete a file (could be in an archive file), and you may have to manually delete something. I would advise that you do not do anything anymore at this time, other than maybe to retrieve the report and note what was done. Slowly, but surely, is the best way to handle these problems.

Cya,
Rich

 

thanks, rich. i'll take a look at that file. i'm not familiar w/kasper, so i didnt think to look - whereas AVG or even the Ad-aware and Spybot will tell you which files...

but i've got a good note, so maybe i'm on the way!!! the very first site i went to to try to fix this was HouseCall and the virus would NOT let me download ActiveX and it'd kick me off my browser. i tried a different website, too, and it did the same thing.

well, after i've just run Kasper (not in safe mode...) and it told me it'd cleaned up 10 files (i'll take a look in a bit), i decided to go back to HouseCall and see what happens. well! i was able to download ActiveX and its scanning my system now!! i did not check 'auto fix'...

 

ok - just went to kasper to view the reports to find out what files were found and what it did, but i dont know where to look. i found something that said, 'view reports' but it just says what it did when (scanned, updated, etc). no file names....

 

zoiks - running housecall and its already found 4 files 'uncleanable', all with the Java Bytever.B & .G virus. wonder what it'll do with those

 

Hi KathyL,

Excellent work!

I am assuming that you are running KAV 5.0. Since I am running 4.5, I can't tell you exactly how to find the report listing that you need to look at. But just hang in there a little longer, and I am sure someone will help you out.

Don't worry about the Java virus. I believe these will be simple to clean. Here is approx. how it will work:

http://discussions.virtualdr.com/showthread.php?t=185513

But again, do not do anything, until more expert advice gets online. Seeing how well things are proceeding, there is no need to hurry. It will take just a little while longer.

One thing this does point out, is the benefits of having a top-of-the-line anti-virus/anti-trojan tool. I believe KAV is one of the best and probably would have prevent the viruses from infecting your machine in the first place. Something to consider after all this has passed.

Cya,

Rich

 

In Kav 5 if it has deleted files you can view them by clicking on the view backup. it should back up any file it deletes. see screen shot.

 

thank you, rich and i do have KAV (much better than kasper, eh?) 5.0 and i did see where it said 'view backup'. i didnt look at that. doing so now...

holy moses. any way to take a snap shot of that or do i have to list each one here and they are quaranteed, not yet deleted.

aand, housecall has just finished scanning and it found 9 files (i'm guessing the same as KAV?) and asking me what i want to do with them: clean or delete...

i'm 'holding'.....

 

Take a screen shot so we can see what it has found

 

luv to. just tell me how. and pretend i've never done one before...