Forum Settings
       
Reply To Thread

Trojan Horse Windows 7 Recovery:Follow

#1 Jun 05 2011 at 6:13 AM Rating: Decent
So I've had experience with the MS removal tool trojan, it took me a while but I got rid of that one (twice, on my parent's computer too).

However, this trojan horse (I think it is anyway) is something else.

The idea is the same, it blocks access to most other programs, runs a 'scan' of the computer and reports a lot of damage, in my case it said that my harddrives are damaged for over 30%. I can no longer access most of the data on my HDD, some directories still show but are 'empty'. All icons on my screen are gone, ctrl-alt-del works but there's no longer a mention of task manager. (when I check my harddrives, they do still mention that there's a lot of data on them, I just can't access it anymore) My favourites list is empty too when I go online, yet when I add a new favourite of something I had on the list before, my computer does say that it already exists, I just can't see it.

I can't start my computer in safe mode, for some reason my keyboard does not function when I try to access this, so I can't chose that option.

However, at first glance, running malwarebytes scanner, seems to have gotten rid of the trojan, or at least it's not showing itself anymore which would be odd as it's just a credit card scam if I'm not mistaken, pushing people to buy the 'solution' to all the so-called 'computer problems'.

I'm still running a full scan with the microsoft security essentials, which together with malwarebytes worked on my parent's computer when they had the ms removal tool problem. But I'm wondering if there's perhaps a setting in windows itself that's perhaps the problem here now, are there settings that can block access to icons and also wallpapers and full directories or am I just kidding myself and is that trojan still messing up my computer?

Anyone have experience with this Windows 7 Recovery trojan?

Thanks in advance!
#2 Jun 05 2011 at 7:52 AM Rating: Excellent
Option B is correct: You're just kidding yourself and the trojan is still messing up your conmputer. Smiley: frown Windows doesn't do that unless something is seriously fragging it up internally.

How old is your computer? Are you using a wireless keyboard, a USB corded keyboard, or a PS2 keyboard? The reason I ask is that older computers can't bootstrap the drivers for certain modern USB things, which would be why your keyboard isn't working (nothing to do with the virus.) If you have a USB anything, I would suggest trying to get a PS/2 keyboard and mouse and using those to see if you can get safe mode to work then.
#3 Jun 05 2011 at 8:13 AM Rating: Decent
catwho wrote:
Option B is correct: You're just kidding yourself and the trojan is still messing up your conmputer. Smiley: frown Windows doesn't do that unless something is seriously fragging it up internally.

How old is your computer? Are you using a wireless keyboard, a USB corded keyboard, or a PS2 keyboard? The reason I ask is that older computers can't bootstrap the drivers for certain modern USB things, which would be why your keyboard isn't working (nothing to do with the virus.) If you have a USB anything, I would suggest trying to get a PS/2 keyboard and mouse and using those to see if you can get safe mode to work then.


I thought as much, although the virus itself doesn't pop up anymore. The microsoft security program got rid of a trojan too, but my computer still refuses to show most directories, icons and taskmanager, it just says that the administrator turned it off and it will not turn it back on by using the run command either unfortunately. It's odd though, I can't access my music directory for instance (correction: my computer says it's empty), but I can play all the music in it through media player.

My computer is about 3 and a half years, I am using an USB keyboard but I can take a ps2 keyboard home from work tomorrow, there are plenty of old ones there I can use.

I'm also going to put Norton back on my computer, I've used it earlier but it just seemed to pop up its head constantly, still I can't recall many problems when I used it so I suppose it just might be worth it after all.

Thanks for the tip!
#4 Jun 05 2011 at 8:33 AM Rating: Decent
Small update: I did get my taskmanager back under the regedit function, granted most likely not smart to go messing about in there, but I was able to reset the disable taskmgr key and got that back. Still, going to have to find a keyboard so I can run safe mode anyway.



edited to add: XTTKaJRdnOjICgJ c:\programdata\xttkajrdnojicgj.exe Tom-PC\Tom HKU\S-1-5-21-3251501502-178971553-219967060-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


It would appear that the above program is also running, I suppose this is the virus I need to get rid off. I'll have to wait till i can run safemode before I can get to it, since I cannot find that particular directory.


Edited, Jun 5th 2011 4:43pm by Zieveraar
#5 Jun 05 2011 at 2:10 PM Rating: Excellent
Avatar
******
29,919 posts
that directory is hidden by default. You have to enable "view protected operating system files and folders" and "Show hidden files and folders" in the folder options under control panel to see them. TO fully clean the virus, please check out the Computer security 101 sticky at the top of this forum. Also, to force safe mode, type "msconfig" in the run box on the start menu (without the quotation marks) and set it to boot in diagnostic startup mode. Same thing.
____________________________
Arch Duke Kaolian Drachensborn, lvl 95 Ranger, Unrest Server
Tech support forum | FAQ (Support) | Mobile Zam: http://m.zam.com (Premium only)
Forum Rules
#6 Jun 06 2011 at 12:17 PM Rating: Decent
Dread Lörd Kaolian wrote:
that directory is hidden by default. You have to enable "view protected operating system files and folders" and "Show hidden files and folders" in the folder options under control panel to see them. TO fully clean the virus, please check out the Computer security 101 sticky at the top of this forum. Also, to force safe mode, type "msconfig" in the run box on the start menu (without the quotation marks) and set it to boot in diagnostic startup mode. Same thing.


Thanks for the tips! I never knew that way to force safe mode.

I have enabled the "view protected..." and "show hidden...", I think anyway. When I check the authorisations for my login, everything is marked as enabled. I was able to restore my taskmanager screen by altering a registry mention, I wonder if that is possible for the other problems as well? (my D drive is "empty", with 80 gig of data on it, for instance, I can't change my wallpaper as this option was turned off by the administrator or that's what my computer tells me anyway)

I've read the sticky at the top of the forum, I'll try and run all steps of it asap!

Thanks again!


(edited to add: at first glance, I might actually just go for a full format and reinstallation of everything, apart from a heck of a lot of music, I'm not losing much that way. Any indication of how long that might take? (windows 7 btw)

Edited, Jun 6th 2011 8:24pm by Zieveraar
#7 Jun 06 2011 at 1:14 PM Rating: Decent
Ok, final update: running several programs (spybot and malwarebytes in particular) under safe mode did get rid of a couple of registry problems and a couple of smaller things too.

After that, I did check config screen again and I finally found the option to make my computer show me all that is on my harddrives again, apparently they were considered to be read-only and hidden. I haven't got everything back as of yet, for some reason my EQII icon is still gone for instance but I might get this sorted out without having to delete everything. I still might do that though, just to be sure that I got rid of all viruses and trojans.

Thanks again for the info!
#8 Jun 07 2011 at 4:46 PM Rating: Decent
Look in malwarebytes logs and find the variant name, Google that name to see everything the Trojan/virus changes so you can undo them. Sometimes malwarebytes doesn't get everything off in the case of very annoying Trojans...and you will have to fix a lot manually.

If you do that you may catch something you might have missed. If not, at least its a good read.

PS - stop using IE, Firefox + no script = 99.9% virus free. .1% more if you tack on good common sense.
Reply To Thread

Colors Smileys Quote OriginalQuote Checked Help

 

Recent Visitors: 137 All times are in CST
Anonymous Guests (137)