Comments | severina2001: Trojan Horse Virus(es)

severina2001

Trojan Horse Virus(es)

Aug 19, 2006 23:47

Please help me ( Read more... )

Comments 17

jackieb78 August 20 2006, 04:42:46 UTC

Oh no! Oh no to all of it!

1. What scanner are you using? Has it been updated? I know, irritating questions, but it matters.

2. When you ran the scan, what virus names did it give you as the culprits?

3. Go into Control Panel | Add/Remove Programs and look for anything related to the virii and remove it. (And lots of times they're called "SaveNOW!" and crap, so look for that).

severina2001 August 20 2006, 04:52:42 UTC

1. It is AVG. It has been updated, I run a full system scan every week.

2. Trojan Horse Downloader Generic2.jvp and Trojan Horse Downloader Generic2.jvq.

Okay. I'd gone into the control panel and deleted one file called ipwins.exe because I *know* it's related somehow... I would see it pop up trying to install on my screen. I also got rid of a few things that looked suspicious.

I've checked online and help desks and it's all foreign to me! And if I don't get that backdoor closed it'll just happen again anyway.

Yeah. Wanna cry.

jackieb78 August 20 2006, 05:13:19 UTC

OK. It's probably going to require you to disable System Restore before you can completely remove the virii. When your computer creates a restore point in System Restore, the trojan gets captured, too. So, it lives in there, hiding, and just comes back. So, they usually want you to disable SR, do the removal, and then re-enable SR. It's not very hard to do, but I don't want to steer you into unfamiliar territory.

ipwins.exe IS spyware, good call. Have you checked the AVG website? I've never used it but I've heard it's a great tool. Sometimes you can plug the trojan name in there to get removal instructions.

These are Symantec's instructions for any Trojan removal (a good place to start):

# Disable System Restore (Windows Me/XP).
# Update the virus definitions.
# Restart the computer in Safe mode
# Run a full system scan and delete all the files detected as Downloader
# Delete the values that were added to the registry.
# Restore the security level of Microsoft Internet Explorer

This is the full article with ( ... )

severina2001 August 20 2006, 06:25:52 UTC

Thanks for going to all that effort. I read the detailed removal instructions and am not confident enough to try it... I don't even understand half of it!

I've just been running *yet another* virus scan and Ad-Aware scan, and this time the scanner let me put the second trojan in the vault. I'd like to think I'm okay now (once I can find and plug the hole, anyway) except that I'm also now at 35 Running Processes and 1578 Process Modules.

Have I mentioned that I just spent 10 minutes bawling?

Do you know if once viruses are in quarantine, if the computer is then safe from them? I mean, once they're in the vault/in quarantine I don't have to do anything else, do I?

I hate computers. And my chest. And sometimes the need to breathe.

(Thanks for putting up with me. You're the best.)

Thread 6

mdlaw August 20 2006, 04:44:29 UTC

I can't help you with the virus, but what browser do you use? If you use IE, STOP. Use another browser. Firefox or something. It will stop the pop ups almost completely, and the ones that do get through, pop up behind the main window. Sorry about the trojan. Did you empty you trash can? You might have to delete from the registry. Spybot usually shows the registry path. m :(

jackieb78 August 20 2006, 04:53:28 UTC

I agree wholeheartedly with that idea. IE is an open door and the updates generally cause more problems than they fix.

Good idea, mdlaw. :) Firefox has a lot of plugins just for stopping adware and popups and it's almost effortless to use.

severina2001 August 20 2006, 04:56:02 UTC

But these pop-ups are not from websites. It's not like when you go to a website and it gives you a pop-up. They're like, backdoor things. I cannot explain. I'm sorry.

severina2001 August 20 2006, 04:55:12 UTC

The pop-ups aren't coming from a website. I mean, they don't happen when I click on a website. They're getting in through a backdoor somehow, last year or 2 years ago I had the same problem (with the pop-ups, not trojan horses) and someone here helped me to fix it, but that was before tagging and I have no idea where that post is.

Gonna cry now.

Thread 6

agneson9 August 20 2006, 09:12:30 UTC

I don't know if the pop-up thing is what I think it is but try this link. Feel better.

Ditto on the Firefox.

severina2001 August 20 2006, 16:22:37 UTC

That was it! I checked and mine is still disabled. Hmmm.

*goes back to drawing board*

And I'll get firefox. I am convinced.

(The comment has been removed)

severina2001 August 21 2006, 01:34:26 UTC

Still not feeling particularly well; I think I need those hugs. And thank you for all the advice. I'm on Firefox now. And I'll look into Spy Sweeper. :)

twistinside82 August 20 2006, 18:45:39 UTC

Oh man. My knowledge is seriously limited to AdAware. I wish I had some magical cure for you!

And are you sick again? Hope you feel better, and can get your computer issues straightened out as well.

severina2001 August 21 2006, 01:35:34 UTC

More like "still". Breathing was bad, then got better for a few months, now is bad again. Grrr.