Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Trojan:Win32/FakeSpypro & Trojan:JS/FakeSpypro

24 Jun 2010   #21
bludgard69

MS Windows 7 Home Premium 64-bit
 
 

Funny thing.I deleted 10G of retore points right after I contracted this thing.
Live and learn,once again.So it was pretty mutch manual labor on this one.
I've got the Take Ownership Of on right-click.Nothing worked.Not even run as admin.
Thank you for your suggestions.I'll look deeper into them shortly.

I think I have this whooped.But,as Confucious says,"We'll See".

Quote   Quote: Originally Posted by Product FRED View Post
First, take a deep breath, calm down. Start the computer in Safe Mode. Find a flash drive and another computer, or if you're confident it's not running in safe mode, download SUPER Antispyware. Secondly, a trojan on a friend's computer once disabled executables for me as well. Right clicking on them and picking "Run as Administrator" allowed me to run them though.

You have plenty of options to deal with this thing. The fact that you're removing it and it's coming back means it's hiding somewhere. You can try rolling back your system with system restore and see if that helps. Otherwise, I'd suggest deleting the restore points because it's usually where viruses like to hide.



My System SpecsSystem Spec
.
24 Jun 2010   #22
bludgard69

MS Windows 7 Home Premium 64-bit
 
 
Possible Hindsight

Maybe MSE already rid my system of these entries earlier in the game?I do know it-MSE- dealt with this in stages.Don't know exactly what happened,I will do more reseach on this,though.Thanks for timely respons.



Quote   Quote: Originally Posted by Tews View Post
How to manually remove Trojan.FakeSpypro



Files associated with Trojan.FakeSpypro infection:


iehelper.dll
Adware_Pro.exe
sysguard.exe
nwdcsysguard.exe
Trojan.FakeSpypro DLL's to remove:

iehelper.dll
Trojan.FakeSpypro processes to kill:

Adware_Pro.exe
sysguard.exe
nwdcsysguard.exe
Remove Trojan.FakeSpypro registry entries:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler{9030D464-4C02-4ABF-8ECC-5164760863C6}
HKEY_CURRENT_USERSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN sysguard
RUNNING PROGRAMExplorer.EXE
HKEY_CURRENT_USERSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN Adware_ProMFCT
HKEY_CURRENT_USERSOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN system tool
RUNNING PROGRAMsysguard.exe
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser HelperObjects{3A44F370-735B-485f-B212-62007E9E6815}
HKEY_LOCAL_MACHINESOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN system tool
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionExplorerBrowser HelperObjects{CFA131B1-3A6E-4c4f-A0CC-4CC9D844B04C}
RUNNING PROGRAM\sysguard.exe
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ system tool
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HelperObjects\{CFA131B1-3A6E-4c4f-A0CC-4CC9D844B04C}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser HelperObjects\{3A44F370-735B-485f-B212-62007E9E6815}

Hope this helps...

My System SpecsSystem Spec
24 Jun 2010   #23
bludgard69

MS Windows 7 Home Premium 64-bit
 
 
Another Malicious File

This has been with me from the start.I renamed it to see if that would help.Nothing found it.I ran "kfsuiwvtssd" through WE Search,and found "kfsuiwvtssd.boo"(which is what I renamed it-Because it sounded scary).Scanned it with MSE,OK.Scanned it with MBAM,INFECTED.Removed.

We'll see how this progresses.


Attached Thumbnails
Trojan:Win32/FakeSpypro & Trojan:JS/FakeSpypro-capturez.png  
My System SpecsSystem Spec
.

24 Jun 2010   #24
bludgard69

MS Windows 7 Home Premium 64-bit
 
 

No recurrence.Everything seems to be running better than ever.Kind of spooky.
My System SpecsSystem Spec
24 Jun 2010   #25
bludgard69

MS Windows 7 Home Premium 64-bit
 
 
Just An Afterthought...

Hey,Product FRED,maybe by me deleting all restore points left this trojan no-where to hide?



Quote   Quote: Originally Posted by bludgard69 View Post
Funny thing.I deleted 10G of retore points right after I contracted this thing.
Live and learn,once again.So it was pretty mutch manual labor on this one.
I've got the Take Ownership Of on right-click.Nothing worked.Not even run as admin.
Thank you for your suggestions.I'll look deeper into them shortly.

I think I have this whooped.But,as Confucious says,"We'll See".

Quote   Quote: Originally Posted by Product FRED View Post
First, take a deep breath, calm down. Start the computer in Safe Mode. Find a flash drive and another computer, or if you're confident it's not running in safe mode, download SUPER Antispyware. Secondly, a trojan on a friend's computer once disabled executables for me as well. Right clicking on them and picking "Run as Administrator" allowed me to run them though.

You have plenty of options to deal with this thing. The fact that you're removing it and it's coming back means it's hiding somewhere. You can try rolling back your system with system restore and see if that helps. Otherwise, I'd suggest deleting the restore points because it's usually where viruses like to hide.
My System SpecsSystem Spec
24 Jun 2010   #26
Product FRED

Windows 7 Enterprise 64-bit
 
 

Quote   Quote: Originally Posted by bludgard69 View Post
Hey,Product FRED,maybe by me deleting all restore points left this trojan no-where to hide?



Quote   Quote: Originally Posted by bludgard69 View Post
Funny thing.I deleted 10G of retore points right after I contracted this thing.
Live and learn,once again.So it was pretty mutch manual labor on this one.
I've got the Take Ownership Of on right-click.Nothing worked.Not even run as admin.
Thank you for your suggestions.I'll look deeper into them shortly.

I think I have this whooped.But,as Confucious says,"We'll See".

Quote   Quote: Originally Posted by Product FRED View Post
First, take a deep breath, calm down. Start the computer in Safe Mode. Find a flash drive and another computer, or if you're confident it's not running in safe mode, download SUPER Antispyware. Secondly, a trojan on a friend's computer once disabled executables for me as well. Right clicking on them and picking "Run as Administrator" allowed me to run them though.

You have plenty of options to deal with this thing. The fact that you're removing it and it's coming back means it's hiding somewhere. You can try rolling back your system with system restore and see if that helps. Otherwise, I'd suggest deleting the restore points because it's usually where viruses like to hide.
That's most likely it. I'm glad I could help.
My System SpecsSystem Spec
25 Jun 2010   #27
Corrine

Windows 7 & Windows Vista Ultimate
 
 

Quote   Quote: Originally Posted by bludgard69 View Post
Hey,Product FRED,maybe by me deleting all restore points left this trojan no-where to hide?
If the only place the files were being found in a scan was System Restore, clearing SR would, of course, remove infected restore points. That said, please note that System Restore is not an endless repository and as new restore points are created, older points are cycled out. Thus, an infected restore point is only a threat if the computer is re stored to that point. However, clearing System Restore should only be done after the computer is clean. Having an infected restore point is better than none should an error be made in the clean-up process.
My System SpecsSystem Spec
26 Jun 2010   #28
bludgard69

MS Windows 7 Home Premium 64-bit
 
 
No Lurkers About...

This thing had roots all over.Registry,AppData,Temp Files......I am new at this,so needless to say I was a bit intimidated at first.

Yeah,I got infected first.Didn't know it.System was running fine.I thought I would do a little maintenance-hadn't done any in a few weeks...Restore was full-Deleted.Ran CCleaner.AV\AM.Auslogics Disk Defrag-with Optimize.Ran Disk Check.ScanNow.Every thing peachy.Restart.


BAM!You know the rest of the story...........

Thanks for responding.





Quote   Quote: Originally Posted by Corrine View Post
Quote   Quote: Originally Posted by bludgard69 View Post
Hey,Product FRED,maybe by me deleting all restore points left this trojan no-where to hide?
If the only place the files were being found in a scan was System Restore, clearing SR would, of course, remove infected restore points. That said, please note that System Restore is not an endless repository and as new restore points are created, older points are cycled out. Thus, an infected restore point is only a threat if the computer is re stored to that point. However, clearing System Restore should only be done after the computer is clean. Having an infected restore point is better than none should an error be made in the clean-up process.
My System SpecsSystem Spec
26 Jun 2010   #29
bludgard69

MS Windows 7 Home Premium 64-bit
 
 
MSE Finds Infected .Zip

Finally,MSE found this file.All I can say is that it got the jump on MBAM.


As a treat,MSE left me my cool icon and the rest of the folders content-PNG images of said trojan.


BE ONE


Quote   Quote: Originally Posted by bludgard69 View Post
Hi,Jaxryley.

Will MBAM remove this if I let it run freely again.Will it find it?I dont have real time protection through MBAM.Is ther a safe way to manipulate this thing to be rid of every thread?
EDIT:MBAM runs since MSE got it quarentined.Just doesn't even find the .zip file pasted on my desktop.I just scanned it-the .zip file- with both MBAM and MSE,neither found it a threat.
Only Bitdefender online scanner found it.

I'LL GET RID OF THIS HOSTAGE TAKING PIECE OF S***!
GAME ON!



Quote   Quote: Originally Posted by Jaxryley View Post
Quote   Quote: Originally Posted by bludgard69 View Post



Let me get back to you guys.I dealt with this thing for 5 hours to get my system back.I need a little time.I apreciate your timely response.
Copy and paste taskmgr.exe from the system 32 folder to desktop and rename to Opera.exe. Now Taskmanager will start allowing to kill the rogue's process then get a scan going with Malwarebytes, updated first of course.

Or you can go to Malwarebytes Programs folder and rename mbam.exe to Opera.exe and Malwarebytes should start even if the exe killing rogue's process is active.

You can rename to Firefox.exe as well. In fact renaming most exes to Firefox or Opera should allow them to run with this rogue active.
My System SpecsSystem Spec
27 Jun 2010   #30
JayC2

Windows xp SP3
 
 

Wooow, intense!
Glad you got rid of it.
My System SpecsSystem Spec
Reply

 Trojan:Win32/FakeSpypro & Trojan:JS/FakeSpypro




Thread Tools




Similar help and support threads
Thread Forum
Trojan.Win32.Jorik.Midhos.axf
I let SuperAntivirus and then Microsoft Security essentials try and take care of the problem. I suspect something is still wrong and I am wondering if some files are missing as the computer is not behaving normally. Any ideas to find out if I am missing part of windows 7 now and if this is...
System Security
Trojan:Win32/FakeSysdef
This computer again: https://www.sevenforums.com/browsers-mail/214851-ie9-32bit-context-menu-fails-w7-pro-64bit.html Here is some of what I know about the box build. I was asked to cleanup the aftermath of this: Encyclopedia entry: Trojan:Win32/FakeSysdef - Learn more about malware -...
System Security
Trojan:Win32/Comroki!rts
Downloaded and ran the Microsoft Safety Scanner and it found this. Trojan:Win32/Comroki!rts Safety Scanner removed so it says. All I found with Google besides sales pitches to buy things is this at MS. Encyclopedia entry: Trojan:Win32/Comroki - Learn more about malware - Microsoft Malware...
System Security
trojan downloader:win32/cutwail.ba HELP!
Microsoft Security Essentials discovered this trojan virus today and three times it said I needed to restart to clean computer yet, it never leaves and is caught again on returning to Desktop. I've looked this up on Microsoft KB and that document says to keep MSSE up to date however, the problem...
System Security
Trojan-Downloader.Win32.VB.bbl
I found this awesome virus "Trojan-Downloader.Win32.VB.bbl" and analyzed its behaviour in a VirtualBox and quickly found a weaknes :p It is very hard to remove, it closes antivirus setups and then deletes them, closes all windows containg anything about antivirus tools (even if you google anything...
System Security


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 20:24.
Twitter Facebook Google+ Seven Forums iOS App Seven Forums Android App