HELP !! WIN32:RENOS-OO Trojan...can't get rid of it

dblue75

Can anyone please help ??? Got this bloody Trojan virus. I have avast and CCleaner on my laptop. Still managed to get it !!! :mad::mad::mad:

I can't do anything to get rid of it...as it won't let me go to any websites...says untrustworthy sites and doesn't let me in...so iam using my other hlafs laptop to try and get a solution to sort this ???

Any help greatly appreciated guys

aliEnRIK

Download MALWAREBYTES (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_malwarebytes_anti_malware/
Open malwarebytes and goto UPDATE and click 'check for updates'. After its updated goto SCANNER and click PERFORM FULL SCAN then click SCAN
Post the COMPLETE log here AFTER youve deleted everything it finds

reboot
Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click MAIN MENU then DO A SYSTEM SCAN AND SAVE A LOGFILE(Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

dblue75

I can't download anything thats the problem.....any website i type in..it comes up with.....

Internet explorer warning-visiting this web site may harm your computer

Then only gives me the option to purchase a 3rd party website antivirus

which is : avtiviruspower.com/purchase?r=78.8&pgid=1

I literally cannot go to any sites even mse.....I am using my GF's laptop to do this and try find a solution.

I managed to get Microsoft malicious removal tool onto a USB stick, transfer it and boot it up on my infected laptop(only by restarting the system and getting it loaded up before the WIN32:RENOS kicked in)

It is currnetly running and has been for an hour. DO you think it will be of some help or should i quit it and try something else ???

Any prog i try to run or open it interupts and ends it !!! so i can literally NOT goto a website as it stops it OR download anything as it also stops that too.... AAaaaargh

Donnie

Download the programs on to a CD or USB drive and run them from there.

fiddiwebb

Have you tried downloading Malwarebytes via safemode with networking?

If that does not work download Superantispyware portable (link below) onto a USB memory stick from your GF's laptop and then run it on the infected computer.

That might shift enough to be able to download Malwarebytes, if it doesn't work come back and someone will give you further advice.

http://www.superantispyware.com/portablescanner.html

dblue75

Tired putting the programs onto a USB stick...no avail.....the virus interupts any program as soon as it tries to run or open..must just have been lucky with the microsoft malicious removal tool.

Not too sure how to run programs in safemode....can you guys gimmie a run down of what to do please ???

Donnie

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx?mfr=true

fiddiwebb

dblue75 wrote: »

Tired putting the programs onto a USB stick...no avail.....the virus interupts any program as soon as it tries to run or open..must just have been lucky with the microsoft malicious removal tool.

Not too sure how to run programs in safemode....can you guys gimmie a run down of what to do please ???

Is that Malwarebytes or Superantispyware portable on a USB stick downloaded from your GF's laptop and then used on your infected computer won't open?

dblue75

Correct....as soon as i got to open ANY program or website...the virus stops it !!! and you cannot go any further....need to try it in safemode to hopefully get it work.

Soory..just read the last post again....it was superantispyware that wouldn't open....gonna attempt to go into safe mode now and try malwarebytes.

Wasn't sure how to do it in safemode.

Ximian

If you're still unseccuessful using safe mode, it might be worth trying to manually remove the trojan, although the instructions below are for the RenosIO trojan, it might apply in your case.

To remove Win32.Renos.IO, you must first stop any Win32.Renos.IO processes that are running in your computer's memory. To stop all Win32.Renos.IO processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for Win32.Renos.IO, then right-click it and select "End Process" key.

To delete Win32.Renos.IO registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\Win32.Renos.IO." Right-click this registry key and select "Delete."

Finally, to completely get rid of Win32.Renos.IO, you must manually remove other Win32.Renos.IO files. These Win32.Renos.IO files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, Win32.Renos.IO might create a file like
%PROGRAM_FILES%\Win32.Renos.IO\Win32.Renos.IO.exe. Locate and remove these files.

Taken from: http://www.spywareremove.com/removeWin32RenosIO.html

fiddiwebb

If you hav no joy in safemode try downloading FixExe.reg and follow these instructions in the link.

http://www.bleepingcomputer.com/virus-removal/remove-antivirus-vista-2010

If that does not work then you may have to run big C programme, I'm not going to say the programme name as someone else who is qualified with dealing with C will advise.