Trojan Horse [Solved]

An hour now with ESET and still at 33% IS this normal?? Very slow running.

Yes ESET can take some time to complete.

OMG, That took 3.5 hours!!! IMHO that is pathetic, but hey, I dont write the programs and know nothing about them so maybe that is good. It was thorough. I want to rid this computer also of all wild tangent carp**. Can that be done? am I best off going through add/remove?? Here is the log. Sorry it took so looooooong C:\Qoobox\Quarantine\C\Users\robbie\AppData\Local\Temp\rty0_7z.exe.vir Win32/Reveton.H trojan Wow, what a log! Very to the point eh! Now since it got hooked to the net it has to update 14 items before reboot. THANK GOD FOR MY MAC I will tell you how it goes soon!

Hi,

Yes ESET can take some time but does a great job.

I want to rid this computer also of all wild tangent carp**. Can that be done? am I best off going through add/remove??

Yes that would be the first route I would go down to remove it. It is always best to use the software's uninstall program or going through Programs and Features from the Control Panel.

That entry that ESET found is already quarantined and will be removed later.

How is your system running?

Now since it got hooked to the net it has to update 14 items before reboot. THANK GOD FOR MY MAC I will tell you how it goes soon! On 5 now of 14. Sorry about the carp comment. Seems to be running fine for now. Since this is a windows 7 I have no idea how to delete the old restore points and make new I would like to remove all the logs and software we put on here to help robbie out. Suggestions on freeware to protect this thing, suggestions on what software to keep? any other thoughts?

Sorry about the carp comment. Seems to be running fine for now.

No problem

Since this is a windows 7 I have no idea how to delete the old restore points and make new

I will take care of that shortly….

I would like to remove all the logs and software we put on here to help robbie out.
Suggestions on freeware to protect this thing, suggestions on what software to keep?
any other thoughts?

We will do that as well. I will remove the tools and give you some good info. I would keep Malwarebytes for sure though. AVG is fine for an antivirus….not one that I myself recommend but it's ok. I only use Avast.

Once you get the updates downloaded and installed let me know how the system is running and we can clean up our tools.

done and rebooted. All seems fine and I can surf the web. Loading and downloading takes so much time anymore and I am on one of the highest speeds comcast offers!!!! Fix me Dr. Jeff!!! Oh, and that notice I was getting is now gone too. good for that!

Great!! Glad to hear everything is running better.
———

Providing there are no other malware related problems…

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
———-

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)

[external image: Posted Image]
———-

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

• Open Internet Explorer
• Click on Tools > Internet Options
• Press Security tab
• Select Internet zone then place check next to Enable Protected Mode if not already done
• Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
• Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. **There are many firewalls that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

7. Finally, I strongly recommend that you read Miekiemoes' great advice How to prevent malware.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Where do I get OTL.exe?

Where do I get OTL.exe?

You are correct…disregard that. I fixed your cleanup instructions. I had several tabs open at once. Sorry about any confusion.

Ok. Combofix is uninstalled. I will do recommended options. HOWEVER, I have this computer set up so he only sees firefox. I have ghostery installed but will add the other to all computers I have. I hate google and their new TOS. Now then: System restore stuff??

Now then: System restore stuff??

Are you referring to removing all of the old restore points? If so…ComboFix did that automatically and created a new one.

How freaking cool is that!!! I guess we can call this closed then? Great job helping me out.

I am glad that I was able to help.

Never mind, I didnt read their directions good enough!

Ok, Next issue Srry bout this. Armor is a paid service and I cannot add something to my CC for someone else. Idea on a free firewall? Avast will be installed shortly.