Windows 7: Help with removing new Trojan

Well didn't take long...my girlfriend's computer with a brand new Win 7 Pro installation has a Trojan...Bit Defender stops it from accessing the Internet and Quarantines it...but it keeps reappearing as a new name. The location is always the same though as shown in the attached JPG. The Folders (source) always stay the same...but Bit Defender just Quarantines it...can't seem to find the source and remove it tho ?



The C:\Windows\ServiceProfiles\NetworkService\AppData\Temp\ is always the same...the wbwb.tmp changes...the svchost.exe is always the same.

When I first opened the W\SP\NS directory...there was no "APPDATA" folder...and some how I managed to get the "\SERVICEPROFILE\NETWORKSERVICE\" to become hidden...while trying to show the APPDATA folder ?

Any help on how to both get the SERVICEPROFILE\NETWORKSERVICE folders to reappear, and, isolate this Trojan and remove it will be greatly appreciated.

Thanks, Tim

You can enable "show hidden files and folders" by going to device manager then choose folder options and click to show files and folder then hit apply. You might try either MalWarebytes or spybot S&D to get that trojen.

I agree with chev65 and suggest you run malwarebytes in safe mode twice

Thanks guys...downloading malwarebytes now (free version I'm assuming ). Do I install this normally before rebooting to safe mode...or install it after rebooting to safe mode ?

Tim

You should install the program normally then reboot to safe mode and run malwarebytes scan.

First thing after install is to check for updates.

Hi there, scan with Hitman Pro.
Downloads - SurfRight

Hello Tim
1. Install it on normal mode.
Update it.
Run Quick scan with it on Normal mode
Tick all detection except those on C:\System Voulme Information folders
Click remove selected.
It will open up lof file.
Post it here.

2. Now run Full scan and tick all drives.
same instructions as above.
Post back log.


For other guys who recommended safe mode. Sorry for hijacking your posts, but: Malwarebytes and Safe mode
Hope you guys will understand me.


+1
Do this one aswell.
Don't worry it's really fast.