Need Help Slaying Trojan Horses

Early B.

My system got infected pretty bad about three weeks ago. What helped a lot was removing Internet Explorer. Right now I'm using Firefox.

Anyway, my antivirus software is AVG. I still have some residual virus crap lingering around and I'd like to get rid of it.

On a daily basis, AVG will catch a trojan horse. They're always located in the same area: C:\System Volume Information\_restore{bunch of numbers & letters.exe}

What should I do?

Thanks.

Face

Download Spybot and Ad Aware. They're both free from Download.com.

As for anti-virus software, I use Trend Micro PC Cillin. I had viruses on my machine neither Norton or Mcaffe could fix. TM was able to fix my machine. I also find it to be less of a resource hog than the others.

Demiurge

Wipe your hard drive and reinstall your OS and hope you backed up your important stuff.

dragon1952

Here's something I found using Google.
http://service1.symantec.com/SUPPORT/nav.nsf/docid/2000092513515106

Systems

xxxxxxxxxxxxxxxxxxxxxxxx

hearingimpared

I use Trend Micro PC Cillin and Webroot Spy Sweeper. I've had both on my PC for a year and never got infected or hooked by spyware.

jakelm

Windows defender helped me alot, and Nortron scan on yahoo toolbar has done a good job too.

SolidSqual

Demiurge wrote: »

Wipe your hard drive and reinstall your OS and hope you backed up your important stuff.

This is the best way. Then quarantine and check all your saved files. In the future look at less **** sites and only download from those sites that are certified.

petrym

Face wrote: »

Download Spybot

Early B.
Have you tried running AVG and Spybot in Safe Mode? Press F8 during POST boot sequence.

Polk user

You can also try taking the drive out and hooking it up as a slave drive and run complete virus scans on the slave drive. Since the drive is not being used as the system drive you have a better chance of removing stuff.

Also, turn off system restore as the virus looks like it could be hiding in a restore point.

While it's hooked up as a slave try running some trojan cleaners like The Cleaner:

http://www.moosoft.com/TheCleaner/Download (run the updates after the download)

jcaut

Have you tried to use system restore? I'm not a big fan of it, because it seems like when you really need it to work, it won't, but... If you know about when the problems started, it might be worth going back and trying to restore to an earlier point. If that won't work, try turning off system restore (you'll then lose all your restore points, so if you're going to try it, do that first) and then running a full scan with AVG. If still no luck, you may have to try hooking the drive up (possibly to another computer, if you don't have another drive you can boot from) as a slave and trying the virus scan again.

Another thing you might try (although again, I'm not a big fan of it) is downloading and running Microsoft's malicious software removal tool. You can get that directly from the MS website or from Windows update.

markmarc

Brad:
In all honesty, I'd nuke and repave the hard drive. I'm a firm believer it should be done once a year, to keep the system performing at a high level. You'll be surprised at the space you'll gain, and the speed increase.
Mark
P.S. how did the window install go?

Early B.

OK, just got back home, so I'll try some of these ideas and report back.

jcaut -- I never used the restore function, but whenever I've tried, it hasn't worked for me either.

Face -- I run spybot and adaware periodically.

lightman1

Syware Doctor from PCtools has kept it clean for me.

Early B.

I ran The Cleaner, but it kept getting hung up, so I removed it. Then I downloaded avast and scanned my system. It found something like 26 trojans lurking in my files, so they were deleted. However, I don't believe it found the ones I was referring to that are housed in system restore.

I'm not computer savvy, so I'm very hesitant to wipe my system clean or turn off system restore, even though I've never gotten it to work. If I turn off system restore, I'm assuming I someone more technically proficient won't be able to use this feature to restore my system, correct? How important is it to keep on?

Systems

xxxxxxxxxxxxxxxxxxxxxxxxxxxx

jcaut

Personally, I say shut system restore off- I think that's where the stuff is hiding. If you end up having to call in more help, they wouldn't use it anyway. Shut it off, delete the saved restore points and run the scan again and it may come up clean. If you get everything cleaned up then you can turn it back on, you just won't have any older restore points.

Do you have your operating system on a disk? Would you lose a lot of important stuff if you have to re-format? That actually is your best bet, but it's a PITA if you have to start from scratch.

I've mentioned this before, but if everyone would partition their hard drive so that they have the OS and their programs on one partition and then all their personal files and stuff on another partition, then use Ghost or one of the other imaging programs to make an image of the partition with the operating system to DVD or CD- Keep your personal documents and files backed up separately- There's really not much that's likely to happen to your computer that is not pretty easy to recover from. That's the way I have mine set up- If i have an install go bad and mess things up, or get a virus, or even have a hard drive fail- I can literally be back up and running like nothing ever happened in about 20 minutes, without having to reinstall programs, drivers, windows updates, etc. Much better than system restore. If you DO end up having to wipe and reinstall, I'd recommend trying to set things up that way as it's much easier to do when you start with a clean HD. I know that doesn't help you with your situation right now, but just FYI.

Face

Early B. wrote: »

Face -- I run spybot and adaware periodically.

I hate to ask the obvious, but do you update them before each use?

Dennis Gardner

I run Mcfee for virals, then Spybot on immunize mode so I never get the bot stuff in the first place.

Early B.

Datastorm -- my computer is less than 2 years old and a fresh install was done about 6 months ago when my previous hard drive crashed.

jcaut -- OK, I'll shut system restore off and scan again. And I have no idea what you're talking about with partitions, so I'll have to get to learnin'.

face -- oh yeah, I always check for the latest version before running spybot and adaware.

SKsolutions

A clean install of XP, is like fresh sheets on the bed.