Subscribe to How-To Geek

Welcome to the How-To Geek Forums

We encourage you to register on our forums and post any questions you might have. The How-To Geeks monitor this forum and will respond to your question quickly.

How-To Geek Forums » Windows Vista

Trojan Nightmare

(11 posts)
  • Started 2 weeks ago by tbodnar
  • Latest reply from xenomorph200
  • Topic Viewed 686 times

tbodnar
Posts: 3

Hey I started out with a trojan virus two days ago. Every time I started my computer a screen would pop up with a virus detected and try to open up internet screens to various websites. Using Malware and going through manually I was able to stop that. However, each time I run a malware scan it continues to find trojan.agents through out the system. On top of that it has affected my ability to go to any website. If I put in the web address it will go to the site but if I try to click on anything it transfers me to a different website. I looked at the links and all the links have been changed to start with www.feedwater.comwith a bunch of other information and then takes me to a different site. I can't even download anything like an autorun program.

Thanks

Posted 2 weeks ago #
Top
 
mfletch
mfletch
Posts: 183

Can you use another computer to download the two free versions of these.

SAS/ Superantispyware http://www.superantispyware.com/

MBAM/ Malwarebytes/ Antimalware http://www.malwarebytes.org/mbam.php

Then transfer them using a CD or usb stick to your computer.

Install both update and run MBAM {quick scan}

Can you then let it remove what it finds and post the log back here in you next reply.

Posted 2 weeks ago #
Top
 
tbodnar
Posts: 3

I have already used the MBAM several times and it continues to find trojan viruses that it will delete upon rebooting. After each reboot I use the MBAM and it continues to find more viruses. Even my McAfee is now picking up a virus listed as Opachki.a!Ink

Posted 2 weeks ago #
Top
 
LH
LH
Posts: 7458

The Report button is for informing the Moderators that something is not right. Not to bring attention to your post :)

Posted 2 weeks ago #
Top
 
mfletch
mfletch
Posts: 183

It would still be good to see the MBAM log if possible

Posted 2 weeks ago #
Top
 
tbodnar
Posts: 3

I have finished both the SAS and MBAM. There are still trojan viruses affecting the system that according to MBAM needs the computer to be rebooted in order to possibly delete it. McAfee is still coming across the Opachki.a!Ink Trojan as well. The MBAM log has the following listed:

Memory Modules Infected:
C:\WINDOWS\system32\calc.dll (Trojan Agent) ->Delete on Reboot

Registry Values Infected:
HKEY_LOCAL)MACHINE\SOFTWARE\Microsoft\Windoes\CurrentVersion\Run\calc (Trojan Agent) -> Delete on Reboot
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windoes\CurrentVersion\Run\calc (Trojan Agent) -> Delete on Reboot

Files Infected:
C:\WINDOWS\system32\calc.dll (Trojan Agent) ->Delete on Reboot
C:\Documents and Settings\Tina Bodnar\Local Settings\Temp\nsrbgxod.bak (Trojan Agent) ->Delete on Reboot

Posted 2 weeks ago #
Top
 
mfletch
mfletch
Posts: 183

Is there more than one account on the computer?

If yes run MBAM on all accounts then do a reboot.

Posted 2 weeks ago #
Top
 
algotechie
algotechie
Posts: 110

Hi tbodnar

Sorry to say but I feel your computer is highly messed up and is full with malware like viruses. The only good solution would be to backup your important files and reinstall the OS. Before transferring the backed up data back on to the system, install the updated and reputed anti-malware, anti-virus, anti-spyware, anti-everything, and do a full scan of the backed up data as well as the whole system. IMHO, that would take less time than it'll for removing the mess that the system's managed to get. (Consider this: A full reinstallation of OS and all the applications/drivers would take about two or three hours. Then their customization would take approximately 6 hours total. The updates of all the components might take another two hours (depends upon the components that need to be updated, the connection speed, and how far behind the latest versions they currently are). In short, one day.

Removing the malware from the current system would probably take longer (let us see from this point forward). Also, some redundant registry entries or files would be left behind. You can never be sure of a 100% clean state once the system's been infected. The best defense is not to get infected in the first place.

But that's just based on my personal experience. Other posters may have better opinions. Thanks for reading.

Posted 2 weeks ago #
Top
 
imsurly
Posts: 1

I found your post looking for a solution to the exact same feedwater.com hijacking both Firefox and IE browsers. Every prior attempt through Windows Defender, McAfee, etc. to scan and remove were ineffective.

I now have apparently solved it, in my case, mainly through reverting to a system restore point prior to the infection.

I can't be sure that all of the following steps were absolutely necessary, but here is what I did specifically.

1. Force quit any browsers where the problem appeared as soon as possible, and without trying to close the browser windows directly or responding to any dialogue boxes. (performed via Task Manager).

2. Restarted the computer in safe mode. (I did this inelegantly by forcing the computer to power down without closing out of anything else). Out of an abundance of caution, since I had multiple accounts on the computer, I restarted in safe mode under a different account than the one that I was using at the time of infection.

3. Opened the system restore options and selected an existing restore point prior to the first appearance of the infection. (Control Panel; System and Maintenance; System; System Protection; System Restore.) (I did all this the same day the computer was infected so it was easy to know which one to select -- I had a restore point from the day before. If you are not sure of when the infection occurred, search your browser histories for the first appearance of "freewater" and select a restore point prior to that).

4. Following restart, since I happened to have Safari on my desktop (even though I'm running Vista and principally use Firefox, which was hijacked), and since I didn't know yet whether the other browsers were clean, I used Safari to download and then installed the MBAM/Malware Bytes program. Upon finishing the installation and before starting up MBAM, I unchecked the box authorizing MBAM to check for any update on its first launching so that it wouldn't try to access the internet to search for or download an update.

5. Ran MBAM and removed any offending results. Following the required restart, I then manually authorized MBAM to update and then and ran it again, and it came back clean.

6. Because the system restore point was prior to my last Windows update, I checked for and installed any important Windows Updates, including updates the the Windows Defender library so that I made sure to have included any recently identified malware.

7. Following the required restart from the Windows update (and still using the Safari browser, although I don't know that it's necessary) I downloaded (or re-downloaded) the most recent version of Firefox.

7. Following the required restart resulting from Windows update, I was able to re-launch Firefox without any re-appearance of the freewater re-directed sites. (Note, if when you restart Firefox, it asks about restoring a previous session or previous tabs, select "Start a new session instead." If, on restarting, it is clear that Firefox is launching two or more tabs (as it does often after an update), try and close all but one tab (the tab announcing "you have been updated"), especially if a tab is taking any time to load. )

Hope this helps!

Posted 1 week ago #
Top
 
BobJam
BobJam
Posts: 878

I agree 100% with algotechie!!!! I'll reiterate and expand.

Your computer seems so heavily infected, it's likely that a malware removal routine (if even successful) will consume more time and produce more headaches than a fresh reinstall . . . which is why algotechie suggested to do that, and also to save your files (malware removal routines can erase all your files, just as a reinstall would anyway).

Bottom line, as algotechie said, your machine is likely so infected that even a malware routine may likely not remove all of it. The only way to be absolutely sure that all malware is gone is to do a clean install.

Save yourself time and headaches, and just do a clean install and be done with it (save all your valuable data FIRST, using algotechie's method).

And when you're done with that clean install, make yourself a clone or an image so you never have to go through these headaches again if you get infected.

The only reason to go through the tedious removal steps is if 1) You don't have backups of your data (on the off chance that a removal routine will leave your data intact), and/or 2) You don't have a clean image ready to substitute. I mean, to reiterate, how are you ever going to be 100% sure that these removal devices have cleaned your machine completely? You may not see any symptoms for a few days, and then something may come out of hiding again. And in those few days you may accumulate valuable data that will be corrupted by the infection(s).

By the time any malware removal procedure is completed (and success is always going to be suspect), as algotechie said, you could've done a clean install and be done with it a lot faster. (I know, I'm repeating myself, but this is important to get).

Posted 1 week ago #
Top
 
xenomorph200
Posts: 14

although the enevetable may well be to re-format and re-install your os as previously recomended have you tried downloading and installing 'spybot search and destroy' which is available from www.filehippo.com as is completely free. i used it when i got a trojan on a pc a few years ago it worked brilliantly and i have installed it on every pc i've worked on since, even norton did not acknowlegde i had a virus let alone a trojan.
also use the immunise function on spybot its great.

my trojan was destroying and deleting windows itself.

Posted 1 week ago #
Top
 

RSS feed for this topic

Reply

You must log in to post.

Our Friends
Getting Started


About How-To Geek
What Is That Process?
svchost.exe
jusched.exe
dwm.exe
ctfmon.exe
wmpnetwk.exe
mDNSResponder.exe
wmpnscfg.exe
rundll32.exe
wfcrun32.exe
Ipoint.exe
Itype.exe
Wfica32.exe
Mobsync.exe
conhost.exe
Dpupdchk.exe Adobe_Updater.exe

Copyright © 2006-2009 HowToGeek.com. All Rights Reserved.