Trojan Horses & Computer Help

self

[hsmomx3]

I am not sure what has happened but I always have my AVG Anti-Virus running and it used to be in the task bar.

Yesterday, something strange happened.

When I noticed it was not there, and after the kids were finished on the computer, I restarted it and got this message:

C\WindowsSystem32\vtsqr.exe

Windows cannot access the specified device, path or file. You may not have the appropriate permission to access the item.

I got into my AVG program and ran it and some 44 Trojan Horse Dropper, generic THT items were found in many programs such as Acrobat Reader, in my AVG program, etc.

After the AVG was run, I ran the check disk option and it fixed many corrupt files.

I am able to start my computer but my AVG program is no longer in the task bar. I can access the internet as well but I am not sure if this problem will affect my ability to install software in the near future such as tax software, etc.

And there are times when I am on the internet and when I get out of it, all of my icons and the task bar are not on the desktop and I have to restart the computer.

I do not know how to get the Windows System 32 (as listed above) to load.

I am running Windows XP, SP1. My computer is about seven years old.

[csvset]

I can suggest this forum, SpywareInfo . They'll help you.

Here's a link to help you get started.

SpywareInfo Forum FAQ

It may take several steps, it may not be an instant fix.

[hsmomx3]

Thanks.

Forgot to add that I do have the Adaware program on my computer as well.

[hflynn]

Navigate All Programs --> Accessories --> System Tools --> System Restore --> Restore my computer to an earlier time. Hopefully you have been taking restores once a week.

I also recommend downloading freeware Spybot - Search and Destroy and running it.

[NucSubs]

I had a Trojan Installer which was turning off my Norton Auto Protect. I downloaded it myself in a game patch and should have known better so I had no one to blame but me.

Point is, I could not get rid of it and had to restore the Ghost copy of my hard drive.

That was the bad news. The good news is that there is nothing like a nice, clean, re-formated system. Fast and clean again. I have been Ghosting every week since and I think I am going to re-format the system every 6 months from now on!

Anyway, when you get rid of it I would get Ad-Aware, Spybot, and SpySweeper in addition to your anti-virus program.

[COUNTrecount]

http://www.kaspersky.com/downloads

This saved my laptop.

[ShadowAce]

[libbylu]

I got a trojan with AVG and bought Norton’s, use my computer for work and can’t afford to go down. They gave us 3 choices.
i had used avast for several years before that with NO problems.

[texas booster]

I use AVG religiously, but it will not provide complete protection by itself.

There are just too many entry points of infection in most Windows systems.

1. Running AVG is a very good thing. Keep it scanning at least once a week, if not every day.

2. Add Spybot 1.5 to the system. While it takes a bit to start up, that is normal. Accept the updates, allow it to install immunize the system and then run the Search.

I get Spybot here:

http://www.majorgeeks.com/downloads31.html

3. If needed there are Java protections and Spyware blockers. I normally use only the above two programs and beg my customers to update and scan. Sometimes they do it themselves, sometimes I do it for them and send them a bill.

You will find more professional help on this forum than anywhere else, especially for nonprofessionals. FR is incredibly kind to their fellow FReepers.

Except for opuses and flame wars.

And the secret Viking Kitty Special Services. Which, as we know, doesn't exist.

[texas booster]

Also, run the Windows Updates regularly.

And buy your kids a Mac Mini.

[Varmint Al]

GHOST is GREAT! I use a floppy generated from Ghost 2002 that I got with Norton System Works Pro. It takes about 12 minutes to save my complete C-Drive onto another partition. Quite a few times I have had to revert back to a previous Ghost Image. Also with my current 2003 Ghost Explorer, I can copy any file(s) from previous Ghost Image files and don't have to restore the whole thing to merely get a file.

Good Hunting... from Varmint Al

[JerseyHighlander]

Hi,
one question, are you running Win XP Home or XP Pro?

Run Spybot and Adaware as mentioned above.

CCleaner..run this before malware scans, also has a registry cleaner
http://www.snapfiles.com/reviews/CCleaner/ccleaner.html

second, d/l this:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis
run it.
Save the output logs and write down their location.
You can then go to http://forums.spywareinfo.com/ and ask for help also.

third, if you have someone around who knows a bit about this, use this:
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Do not go removing stuff unless you are sure you know what you are doing with this program.

Some more suggestions:
[1] http://research.pandasecurity.com/archive/New-Panda-Anti_2D00_Rootkit-_2D00_-Version-1.07.aspx Freeware, Windows 2K, XP.353KB
[2] http://www.microsoft.com/technet/sysinternals/utilities/RootkitRevealer.mspx Freeware, All Windows, 231KB
[3] http://www.sysinternals.com/Forum/default.asp

[Vinnie]

This is good also, will scan your computer for you.
http://housecall.trendmicro.com/

A friend brought his laptop to my house that was almost unusable. We ran Trend Micro Housecall and got rid of several malware but 1 wouldn’t budge.

Kaspersky got rid of it, and my friend now runs Kaspersky.

I run Trend Micro on my PCs and am happy with it.
My 2 month old Mac Book Pro is naked and during the next year plan to go all Mac.

[holymoly]

I got into my AVG program and ran it and some 44 Trojan Horse Dropper, generic THT items were found in many programs such as Acrobat Reader, in my AVG program, etc.

It's doubful any single program will find & cure everything on your system.

I suggenst giving "Dr. Web CureIT" a try (below). It does not require installation. Simply download to a folder on your HD, & run the executable.

A-squared free (below) is a dedicated anti-trojan.

After that, you may want to download, update & scan with SUPERAntiSpyware.

If/when you get your system clean, you may want to consider a multi-layered defense.

I.E. I recommend Spywareblaster. Because of the way it works (placing "killbits" in the registry, etc.), once its' protection is in place, it uses no system resources.

Sybot - Search & Destroy has an "immunize" feature, which works in a similar manner. You may also want to consider using Spybot S&Ds' resident "TeaTimer". Note: There are a few bugs in the latest version of Spybot S&D (1.5). For now, I suggest getting Spybot S&D 1.4 from www.oldversion.com

Obviously, if you're using MSIE, stop. Firefox, Seamonkey and Opera are all safer.

And here's my list of security applications, that won't take a bite out of your wallet. Good luck, and Merry Christmas.

PC security-related links.   All software listed is freeware or open source. Last Update: 08/16/2007  List maintained by holymoly.
Anti-Virus: avast! Home Edition  Windows 95/98/ME, 2000/XP AVG Anti-Virus Windows 98/ME, 2000/XP BitDefender Free Edition Windows 98/ME, 2000/XP On-demand anti-virus program. ClamWin Windows 98/ME, 2000/XP On-demand virus scanner. Detects, doesn't clean. Dr. Web CureIT! Windows 95 OSR2/98/ME, 2000/XP On-demand, anti-malware (anti-virus/spyware). Detects and cleans. No installation required. McAfee Stinger On-demand anti-virus/trojan. No installation required. Fits on a 3.5" floppy.	Alternatives to MSIE, Outlook & Outlook Express: Mozilla.org  Firefox browser, Thunderbird E-mail client, Mozilla Suite. Opera  Supports tabbed browsing, etc. Easier on resources than Firefox, Mozilla/Seamonkey. Off By One The world's smallest and fastest web browser. No installation required. Popcorn E-Mail Small, no-frills e-mail client. Seamonkey The successor to the Mozilla Suite.  Web-browser, e-mail/usenet client, IRC client, HTML editing, all in one application. Xnews Usenet client.
Anti-Adware/Spyware/Trojan: a-squared Free Windows 98/ME, 2000/XP, 2003 Server & Vista On-demand anti-trojan/rootkit, etc. Comodo BOClean Windows for Workgroups 3.11 , 95/98/ME, NT4 SP2+, 2000/XP & Vista. Full/real-time protection against trojans, rootkits, etc. SpywareBlaster  Windows 95/98/ME, 2000/XP Prevent the installation of spyware and other potentially unwanted software! SpywareGuard Windows 98/ME, 2000/XP Full/real-time protection against spyware/malware. Spybot - Search and Destroy  Windows 98/ME, 2000/XP Offers both on-demand scanning and full/real-time protection. SUPERAntiSpyware  Windows 98/ME, 2000/XP Remove spyware, adware, trojans, keyloggers, home page hijackers and other malware threats.	Firewall: How to Install a Firewall Kerio Personal Firewall 2.1.5 Windows 98/ME, 2000/XP (Last freeware version) Tiny Personal Firewall 2.0.15A Windows 95/98/ME, 2000/XP Tiny Personal Firewall 2.0.9  Windows 98/ME, 2000/XP (Last freeware version) ZoneAlarm Free Download Zonealarm at Oldversion.com For those who need a version compatible with Windows 9x/ME
Miscellaneous: CCleaner Windows 95/98/ME, NT4/2000/XP/2003/Vista A freeware system optimization and privacy tool. Over 65 million downloads! Dr. Web anti-virus link checker  OS Independent This plugin/extension allows you to check any file you are about to download, or any web page, with Dr. Web anti-virus. Firefox users may download the extension at Addons.Mozilla.Org MVPS HOSTS File  Windows: All Block known malicious websites & servers. Ping Plotter Windows: All Internet diagnostic tool. Proxomitron  Windows 95/98/ME, 2000/XP A free, highly flexible, user-configurable, small, but very powerful, local HTTP web-filtering proxy. WinPatrol A security monitor.  WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission.	New and/or Untested: Lavasoft Ad-Aware 2007 Free Windows 2000/XP/Vista (On-demand?) Anti-adware/spyware. Microsoft Windows Defender Windows XP SP2 or later. Anti-spyware. Spyware Terminator Scanner (On-demand): Windows 98/ME, 2000/XP/Vista Real-Time Protection: Windows 2000/XP/Vista TC-Spy Windows 98/ME, NT/2000/XP/Vista On-demand anti-adware/spyware.
Zeroday Emergency Response Team (ZERT) "The nonprofit Zeroday Emergency Response Team is offering VML security patches for out-of-support Windows OS versions. The volunteer group, which is made up of well-respected security professionals, has released updates for Windows 98, Windows 98 SE, Windows ME, Windows 2000 and Windows 2000 SP3." Above quote from: ZERT Patches Out-of-Support Windows OS

[Bloody Sam Roberts]

I am able to start my computer but my AVG program is no longer in the task bar.

The icon you speak of....is this usually in the System tray (near the clock) on the lower right? Or is it the icon that you use to laucnh the program from the Quick Launch bar on the left (near the Start button)?

If it is usually in the System tray, this is only the AVG Control Center. The process that runs while the Control Center icon shows up is called "avgcc.exe". It is not necessary for this to be running in order for the PC to be protected. That is the responsibility of another process called "agvamsvr.exe".

You should go into the Task Manager (right click on the task bar) and see if either one is listed under the Processes tab.
If avgcc is there but you have no icon in the SysTray, then AVG may be hosed and should be uninstalled and reinstalled.
If avgcc is not running, go to Start>>Programs>>>AVGFree and start the Control Center. You might also check to see if it is the Startup group or is set to run at startup by checking with 'msconfig'.

[NucSubs]

It is great. I STILL don't understand how it works, but man it does.

Turns a 12-24 hr job into a couple of hours tops.

[tutstar]

download Spybot

[UsnDadof8]

In addition to all this I would recommend downloading SP2.

[chaosagent]

bookmarked

[hsmomx3]

Thanks soooo much for the links, etc.

In addition to the AVG program, Adaware which I already have, I also ran the “Dr. Web CureIT” and that picked up on the one thing AVG could not heal and it was the trojan in that windows path!!

I am back in business but I have been running a quick scan each time the kids get off as I found another one in their ITunes program.