Need some help got a trojan

Shinra · 31 Jan 2011

Hello,
First off sorry if this is in wrong area.
My parents have got a trojan ( Smart internet protection) even tho they was protected using Mcafee internet security. Anyways, when i tried to open mcafee to run a system scan it would not let me. I don't know any thing about what to do, i have bought a nortan internet security protection but it wont even let me install it.
Any help would be much appreciated.
All so i can't even make a back up disc for the computer

WesCole · 31 Jan 2011

Try booting into safe mode, then loading the anti-virus. Sometimes this works...otherwise, make a note of the file path where the virus resides and delete the file in safe mode. Hope this helps.

DMHolt57 · 31 Jan 2011

Boot the computer using the F8 key and choose Safe Mode with Network. Download Malwarebytes Anti Malware free version and run it.

EzioAuditore · 31 Jan 2011

Please download and run RKill.

Download mirror 1 - Download mirror 2 - Download mirror 3

Save it to your Desktop.
Double click the RKill desktop icon.
It will quickly run and launch a log. If it does not launch a log, try another download link until it does.
Please post its log in your next reply.
After it has run successfully, delete RKill.

Note: This tool only kills the active infection, the actual infection will not be gone. Once you reboot the infection will be active again! Please do not reboot until instructed further to do so.
Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Full Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Shinra · 31 Jan 2011

I have looked and i can not find where the trojan resides, all so i use f8 and start in safe mode with networking but it wont connect to the internet.
If maybe some one knows where abouts i can look for where it resides, that would be very helpful.

All so thanks for the promp responses so far

Ambimom · 31 Jan 2011

When you F8 select safe mode with networking; that will give you access to the Internet.

Shinra · 31 Jan 2011

hi i have run rkill but the computer that it is on will now not connect to the internet, so using laptop.
the log says
this log file is located at C:\rkill.log.
please post this only if requested to by the person helping you.
otherwise you can close this log when you wish.

rkill was run on 31/01/2011 at 18:19:22.
Operating System : windows 7 Home Premium

processes terminated by rkill or while it was running:

C:\windows\SysWOW64\InfDefaultInstall.exe
C:\windows\SysWOW64\runonce.exe

rkill complete on 31/01/2011 at 18:19:28

Shinra · 31 Jan 2011

windows network diagnostics
trouble shooting has successfully completed

problems found

Then remote device or resource won't accept the connection detected then a ! mark in a yellow triangle

have not restarted the computer, the symbol for the trojan has gone off the task bar at the bottom of the desk top. But in the windows start it is still there. It is showing there twice

EzioAuditore · 31 Jan 2011

Download Malwarebytes Anti-Malware and its update file from here - http://data.mbamupdates.com/tools/mbam-rules.exe to an uninfected computer.
Copy the files to any CD/DVD or flash drive and transfer it to the infected pc.
Install Malwarebytes Anti-Malware. Close it if its open.
Run the mbam-rules.exe file to update MBAM.
Run a full scan.

Jacee · 31 Jan 2011

Smart internet protection is a new clone in the same group as these previous trojans.
Follow the instructions here, in order to run MBam!
How to remove XP Security Tool 2010, XP Defender Pro, and Vista Security Tool 2010 (Uninstall Guide)

Copy and paste the log back here when finished.