The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.

One Badass Trojan.

TransporterTransporter Registered User regular
edited April 2009 in Help / Advice Forum
Okay, so, apparently, I picked up a trojan a few weeks ago on a site that hasn't given me any problems for YEARS, and I have the sneaky suspicion it's bending my computer over backwards.

I have AVG free and I'm backing THAT up with Windows defender(olol), and they both say they've gotten it, but I'm am completely not convinced.

The reasons why is that, well, this Trojan apparently killed internet explorer dead.

Which forced me to get Firefox. Which wouldn't be an issue, because I like Firefox.

Except that apparently somthing on my computer keeps trying to access I.E. occasionally at odd times/everytime I open a new webpage and windows constantly has to remind me that I.E. is dead and there is no bringing it back.

So I wanted to just simply delete I.E., but apparently I just can't do that either.

I want to take a bazooka to the whole process, backup the shit I want, and just wipe the sonovabitch but I would have to go to Best Buy to do that because I don't have windows disks and I HATE Best Buy.

So.

WHat the hell else can I do?


Edit: Oh, and one last thing. My System Idle Processes are eating up a SHITTON of resources which I know is not normal.

Transporter on

Posts

  • VirsoulVirsoul Registered User regular
    edited April 2009
    Edit: Oh, and one last thing. My System Idle Processes are eating up a SHITTON of resources which I know is not normal.

    Do you mean it's using a lot of your CPU in the Windows Task Manager or that it has a high memory usage? If it's the first one, then that's normal. If you're doing nothing it should be in the high 90's depending on background programs. If you're running something demanding on the processor you'll see it drop greatly.

    If the memory usage is high, it definitely should not be high.

    Virsoul on
  • TransporterTransporter Registered User regular
    edited April 2009
    Virsoul wrote: »
    Edit: Oh, and one last thing. My System Idle Processes are eating up a SHITTON of resources which I know is not normal.

    Do you mean it's using a lot of your CPU in the Windows Task Manager or that it has a high memory usage? If it's the first one, then that's normal. If you're doing nothing it should be in the high 90's depending on background programs. If you're running something demanding on the processor you'll see it drop greatly.

    If the memory usage is high, it definitely should not be high.

    It's middleground. Is 50% odd memory usage normal? Because it dosen't really seam like it should be that high.

    Transporter on
  • I'd Fuck Chuck Lidell UpI'd Fuck Chuck Lidell Up Registered User regular
    edited April 2009
    depends on how much ram you have

    either way go to safe mode, msconfig, and choose too only boot what is necessary for your computer to run. this will disable it, then rerun all of your antivirus, including spybot, adaware, and another one i can't remember that runs out of safe mode (hopefully someone remember it here?) if that doesn't get it, at least it wont be running

    I'd Fuck Chuck Lidell Up on
  • theclamtheclam Registered User regular
    edited April 2009
    Run MalwareBytes AntiMalware.

    theclam on
    rez_guy.png
  • urahonkyurahonky Cynical Old Man Registered User regular
    edited April 2009
    If you have your windows disk you can reinstall internet explorer (or completely remove it). Put the disk in and click on "install additional components" and uncheck Internet Explorer and that should remove it.

    Sounds like something is trying to open internet explorer using the "iexplore" command. Hold the Windows key and press R, then type in msconfig and then disable all the startup items and see if that does anything (reboot afterwards).

    urahonky on
  • SkyGheNeSkyGheNe Registered User regular
    edited April 2009
    When was the last time you had a windows update? Might be conficker.

    SkyGheNe on
  • CrashtardCrashtard Registered User regular
    edited April 2009
    theclam wrote: »
    Run MalwareBytes AntiMalware.

    Pretty much this. This is pretty much the same advice from every other Trojan/Virus/Other thread, and it pretty much solves any problem you'll have except some pretty specific stuff that requires it's own fix.

    Crashtard on
    I pinky swear that we will not screw you.

    Crashtard.jpg
  • Shark_MegaByteShark_MegaByte Registered User regular
    edited April 2009
    When you don't have Windows discs, you're looking at taking a whole weekend to wage war on that sucker.

    It's always best to identify the thing - if AVG gave you a name to go by, look that up and look for specific removal instructions. If you didn't get a name, check for dodgy-looking processes or other strange behavior and google for help-forum threads made by people looking for the same thing, you may get a positive ID from their responses.

    It's always easier if you can find where someone else has already figured out what to do to kill the infection 100%, and then just follow that recipe.

    If you cannot find that, you'll probably need to brute-force it. Get every free anti-virus/malware tool you can find (start with: Ad-aware, HijackThis!, CrapCleaner, the latest Malicious Software scan&remove tool from Microsoft), scan and clean with each of them once, then reboot and repeat. Then repeat again. If you still see wacky behavior or are getting very suspicious scan results (these things can be sensitive and often bark at harmless cookies) after the second reboot, you need to bring more heat to the battle. Research the problems you're seeing again, look for more tools, and you may need to manually hunt and remove files and/or registry keys that the thing is using to keep itself alive.

    Shark_MegaByte on
  • Desert_Eagle25Desert_Eagle25 Registered User regular
    edited April 2009
    Desert_Eagle25 on
  • blakfeldblakfeld Registered User regular
    edited April 2009
    What brand is the computer? Quite a few have restore partitions these days. As a Geek Squad employee, we actually aren't allowed to restore your computer if you don't have your disks or a partition. Legal hallabaloo

    blakfeld on
  • tardcoretardcore Registered User regular
    edited April 2009
    I like to use Process Explorer, it lets you kill any tree that you don't want running in the background.

    tardcore on
  • theclamtheclam Registered User regular
    edited April 2009

    I wouldn't recommend running combofix, unless you have to. It's very powerful, but on rare occasions it has nasty side effects.

    As for as some of the other ones mentioned:
    Spybot and Adaware used to be good, but they don't really root out any of the nastier bugs anymore. I've never had them fix anything that MalwareBytes or Combofix couldn't.

    Make sure you're updating all these programs before you run them and be sure to run them in safe mode.

    theclam on
    rez_guy.png
  • Torque MonkeyTorque Monkey Registered User regular
    edited April 2009
    superantispyware and hijackthis are two other options which are very viable on the free side, if you opt to use hijackthis, I would highly reccomend running it and posting the log here and one of us can once it over, because you really do not want to remove the wrong thing.

    If MalwareBytes, SuperAntiSpyware, Hijackthis! and ComboFix don't get it, then restoring may be your best alternative. Like blakfield, speaking as a Geek Squad employee, you don't have to go to Best Buy to get discs - what brand is your computer?

    Torque Monkey on
    Gojira2.png
Sign In or Register to comment.