Root Kit Zero Access / Win32 Patched HN Trojan

RussJK

You can try downloading things and changing the name before you download them, e.g. in the save target as dialog.#

Anyway, give the online scanners a go, and if not then it'll be what you can do with the various boot up options (e.g. system restore), up to and including reinstalling.

Alternatively, find someone with a computer and an external hard drive caddy/hard drive dock, and do some scans from their computer.

Silver-Cat

no luck, google chrome is now no longer working. arghhhhhh
any other online scanners recommened please?

Toxteth_OGrady

Silver-Cat wrote: »

any other online scanners recommened please?

Plenty to choose here:

https://forums.moneysavingexpert.com/discussion/78360

Silver-Cat

All crash, one by one

RussJK

What happens when you try each of these, please be specific:
http://www.users.on.net/~russ/hj.com
http://www.users.on.net/~russ/hj.scr

Silver-Cat

Will try that in a min, just trying a boot scan from a cd called bit defender which my bf found from googling the Trojans name. So far It's found 3 things as used a LAN cable to update definitions. Here's hoping! Will update with results.

RussJK

Oh, didn't realise you had another computer to work with! Yes that's a very good idea. What is the trojan's name, I don't think you mentioned it?

Once the scan is done, and Windows boots, you might have to repair the registry.
http://download.bleepingcomputer.com/reg/FixNCR.reg

Silver-Cat

It's called win32\patched HN Trojan. Also one scan called it Trojan dropper /SVC host,

The scan found 3 files and deleted them, so I rebooted windows and there is no change still and super anti spyware finds it still before getting shut down.
Arghhhhhhhhhhh

RussJK

Could also be false positives of Gdata or Trend Micro, as they both pretend to be SVCHost as well.

Bitdefender isn't the best bootdisk antivirus IMO. I prefer Avira (quick); but Dr Web is better at rootkits but takes like a day to finish! On the plus side, it has a web browser so you can use the computer during that time. Kaspersky is quite good, so is F-Secure. Panda is quite quick, and is better for trojans (all IMO).

I've already made a list of them here:
https://forums.moneysavingexpert.com/discussion/comment/41653210#Comment_41653210

stilltheone

Have you tried System Restore or has access to the points been blocked?

Vista System Restore

If you can't run it from Windows,, you will need to enter System Restore from the Vista Windows Recovery Environment. You 'll need a disc in that instance.

Follow these instructions in order to create one:

Download and save this Vista Recovery Disc Image to a working computer.
Next, download and install ImgBurn(No need to install the Google Toolbar. Remove the relevant tick). Burn the Image to Disc. Use this guide(skip step 2b)