Trovi Virus - help to remove please

[Borg 386]

Yes, continue with the removal guide. I was just wondering if you d/l ed the Windows ISO to make a Windows Seven disk for re-installation. If you do so, make sure you d/l & make it on a clean PC. Otherwise the data on it could be corrupted by the infected PC.

 

[Tousdae]

Text file of adw report attached. You see how it says the pc name is Sorci? When I reinstalled both times I changed my pc name. How is it remembering these things??

K, thanks Borg.

 

[Borg 386]

The malware is obviously coming from somewhere, I would guess it's either a rootkit or the Windows Disk your using has the malware on it. Run TDSSKiller, it's a quick scan & if you do have a rootkit, then we've found the source. Otherwise, it might be a good idea to re-make the Win 7 disk on a different, clean PC & do the clean re-install as suggested by gregrocker.

 

[gregrocker]

In addition scan your backup where the files you're importing into new install are kept.

 

[Tousdae]

Ok so I using the guide I followed the steps to remove from windows, remove from IE, remove from Chrome. I scanned with adw cleaner and it found 1 thing within IE. Malaware bytes says I'm clean. Hitman Pro found 8 traces and took care of them. Now I'll scroll up and try the new directions.

 

[Tousdae]

TDSSKiller = reg cleaner pro?

 

[derekimo]

TDSSKiller = reg cleaner pro?

No, TDSSKiller = TDSSKiller

TDSSKiller Download

 

[Tousdae]

I'm using Super antispyware prof to scan drives. Scanning external hard drive as directed.

 

[Tousdae]

Thanks Derekimo. It's downloaded and scanning.

Malaware bytes comes up with nothing.

TDSSKiller says there aren't any threats.

 

[Slartybart]

The first two steps of the guide are manual steps - you have to follow each instruction in these steps.
There isn't an automated way to do this in the guide.

STEP 1: Uninstall Search Protect by Client Connect LTD from Windows
STEP 2: Remove Trovi Search and trovi.com from Internet Explorer, Firefox and Google Chrome​

The last three steps are on-demand malware scanners.
Each scanner produces a log - You only posted the AdwCleaner log and that was from 7/11/14
If you want to clean your system of this virus, you have to complete the steps given in a timely fashion and post the current logs here on SevenForums so that members can assist you if further action is needed.

STEP 3: Remove Trovi Search browser hijacker with AdwCleaner
STEP 4: Remove Trovi Search and trovi.com with Malwarebytes Anti-Malware Free
STEP 5: Double check for the Trovi Search infection with HitmanPro​

 

[Tousdae]

Steps 1 and 2 were done manually. Steps 3,4 and 5 are finished.

 

[Tousdae]

Another log.

This super antispyware prof scan is going on 2 hours o.o Which is a bit annoying. Windows wants to update but I can't restart.

 

[gregrocker]

Never seen that.

There's no need to buy it which is why I suggested you Decline Trial to use the scanner only.

I suggest to those who are chronically infected to add MBAM Real Time protection at $29 for life, but its scanner is enough otherwise too.

Otherwise MSE and safe browsing habits (watching every choice like a hawk during installs) is enough.

 

[Tousdae]

Does it appear that Trovi is finally off here?

 

[Slartybart]

Thanks Tousdae,

The logs look clean, a few tracking cookies, but no Trivoli, Sweatpea, Conduit, or (another bug I saw in one of your earlier posted logs).

I noticed that you have two users (from the 7/11 logs).
Are both Admin users? Did you run the scanners on an admin account?

A few more utilities.

Oldtimer - TFC
Restart your machine in case there are any system operations pending

Click here to download Old Timer-TFC.
>> save the application to your Desktop.
:info: Old Timer-TFC is a standalone application, there is no install.

:warn:Save your work and close all open windows.
TFC will close ALL open programs including your browser!

Right click, run as administrator TFC

Click the Start button to begin the cleaning up temporary files and folders.
:warn: Do not work on other things while TFC is running - most applications use some sort of temporary files. Just let TFC run by itself on the machine until it completes.

There is no log to post.

:busted: If TFC prompts you to reboot, do so immediately.
:busted: If TFC does NOT prompt you, then reboot your machine immediately after TFC has completed.
In other words.... Restart your machine immediately after OldTimer-TFC completes.

 

[Tousdae]

Thanks. There's only me using the pc. I have no idea why there are more than 1 name as admin. Any other pc name used was before my clean installs. Sorci was one. Maybe Leah too.

Greg said he never heard of the scan taking this long so I'm attaching a pic. Maybe something is out of the ordinary that you'll see?

I will try the old timer once this scan ends. Thank you

 

[Slartybart]

Eset online scanner - this is the longest running on demand scanner. It could take a few hours, but it does a thorough job

You'll need to run this scanner in IE
Read the help, then press the Run ESET Online Scanner button
The scanner runs in a pop-up window - if you close the window, you close the scanner.

Free Virus Scan | Online Virus Scanner from ESET :: Help


​

Select the options shown below and press the start button

​

 

[Slartybart]

Thanks. There's only me using the pc. I have no idea why there are more than 1 name as admin. Any other pc name used was before my clean installs. Sorci was one. Maybe Leah too.
...

Yes, I recall seeing Leah. If that user no longer exists, then it's just a matter of timing (I saw the log when the user did exist). Thanks for the explanation.

I saw in one log disk5, is there an external drive connected? The more data to scan, the longer a scan takes. The time is also dependent on the options selected - if archives (zip, rar, ISO, etc...) are scanned, it takes a while to unpack them and scan the contents.

Since you say that the virus returned after clean installs, it's best to scan everything. It has to come from somewhere, either you visit a page and it reattaches itself, or there's a remnant (copy from external data?)that hooks back in by some means.

Malware can be difficult to eradicate if you don't get it all in one fell swoop. Please be patient and continue with the disinfection - two final scans will tell if there's anything on your system (one is a cloud scanner, the other a very powerful tool - but you'll just scan with it first)

While you wait for SuperAntiSpyware (SaS) to finish, it might be a good idea to prune your installed programs.

Open Control Panel > Programs & Features
Stretch the window tall and wide enough to show the name and date installed
Post as many screen shots as it takes to show the list

When fighting malware, it's a best practice to uninstall all unnecessary applications that can easily be reinstalled (free stuff). Taskbars, search engines, 3rd party utilities are prime examples of unnecessary applications. When you've completed the malware exercise, you can install them again if you wish.

Go through what you can, starting with the free software, hold off on any purchased software for now.

If you purchased software, you need the license key to re-install those. Do NOT uninstall any purchased software unless you have the key.

I'll look though your installed programs list and make further recommendations. You have the final say on what I suggest, it's your machine.

Bill
.

 

[Tousdae]

Hi, I scanned the external drive becuz someone suggested whatever I use to store my files be scanned also.

That long scan is done. Everything was removed. I don't recall a log given.

I haven't installed much of anything. It didn't seem smart if I may have to do a clean install again.

Firefox is installed too although it's not showing up in programs and features for some reason.

I used to love that eset scan. The suddenly it had to be paid for. I'll check it out. Thanks

 

[Slartybart]

Right! I forgot you reinstalled and I'm glad there's not much software to sort through.

Ok, it was a good idea to scan the ext drive - I jst wanted to let you know that scans will take a longer.

FF is there, it's Mozilla FF (4th from the top)

The only question is: Gamers Unite Snag Bar. Can you do without that for a while until all scans are done?
Did you install it?
See Google Search results
I don't know if it is a very safe thing to have on your machine. It could be the open door that lets viruses in - not sure though. Better to remove it for a short term.

Ok, next do post# 35 OldTimer (short) and then post# 37 ESET (long)

You're doing great, thanks for your patience.

Bill
.