RENOS message....

doorstep

Firstly, please be gentle with me I'm a bit of a computer novice...


A while back I had a malware infection. I followed the steps in the other sticky and the pop up still appeared (something along the lines of you have a spyware infection and should update microsoft).

I've tried tp re-run the steps a few times and it still didn't seem to do a lot.

Now, every day when I open the internet, the windows defender shows that it finds RENOS. I click to remove all, but everyday it's there.

Oh, just had another thought too - I'm having difficulties updating the AVG program, it says that it's unable to connect to ewido updates

I use windows XP, is there an other info you need?

Thanks in advance for any help you can give me - it's driving me up the wall!!


Edited to say - I'm not sure if it's connected at all, but I'm also having problems with my internet connection. The internet disconnects itself regularly and sometimes, I can't even get it to connect. This may be a modem problem though and I'm just having really bad luck....

Browntoa

http://www.sophos.com/security/analyses/trojrenoscp.html


Troj/Renos-CP is a Trojan for the Windows platform.
The Trojan displays the following bogus warning in order to coax users into downloading and installing fake security related software:
Caption:
Warning! Message text:
Your computer is probably infected. Microsoft Corporation recommends you to check your computer on the spyware presents. Click here to download updates

doorstep

Browntoa wrote:

http://www.sophos.com/security/analyses/trojrenoscp.html


Troj/Renos-CP is a Trojan for the Windows platform.
The Trojan displays the following bogus warning in order to coax users into downloading and installing fake security related software:
Caption:
Warning! Message text:
Your computer is probably infected. Microsoft Corporation recommends you to check your computer on the spyware presents. Click here to download updates

oooooh! That's not nice.

Is there anyway I can get rid?

I have run the PANDA scan and it's found 2 bits of spyware. SHould I pay the 8.50 to remove?

donny-gal

http://www.f-secure.com/sw-desc/renos.shtml

Please read this re the Renus problem, it may help you.

GreenNotM

Hi Doorstep

where does it say your infection is ? On this post it is hidden in the c:\recycler folder - aka "Recycle Bin" http://forums.spybot.info/showthread.php?t=1181

If your renos is there - Boot to safe mode with command prompt - keep pressing F8 as the PC starts
Select above from the menu
at the screen type "cd c:\" ( to ensure you are on the root of the c drive )
type "rd recycler /s"
press "y" to confirm
Reboot

If you have more then one drive with a recycle bin change to that drive (eg "cd d:\" and repeat "rd recycler /s" Don't type the quotes " "
HTH

doorstep

GreenNotM wrote:

Hi Doorstep

where does it say your infection is ? On this post it is hidden in the c:\recycler folder - aka "Recycle Bin" http://forums.spybot.info/showthread.php?t=1181

If your renos is there - Boot to safe mode with command prompt - keep pressing F8 as the PC starts
Select above from the menu
at the screen type "cd c:\" ( to ensure you are on the root of the c drive )
type "rd recycler /s"
press "y" to confirm
Reboot

If you have more then one drive with a recycle bin change to that drive (eg "cd d:\" and repeat "rd recycler /s" Don't type the quotes " "
HTH

Sorry if I sound a bit dim....

The last time renos was found it was in the file c:\ winstall.exe

Should i type rd winstall /s ?

I did say i was a novice....:rotfl:

Thanks

Enterprise_1701C

My daughter managed to get one of these bouncers (writer sends minor virus then offers to remove it for a fee), I ended up doing a complete system search for the word that it mentioned (such as renos) and removed the items. Do not be concerned about this, just set a system restore point first (All Programs - accessories - system tools - system restore) then you should be able to recover if it all goes wrong. If you don't want to do this get a mate that knows a bit more to do it!

Browntoa

Removal Instructions:

1. Print out these instructions as we will need to close every window that is open later in the fix.
   
   Download SmitfraudFix.exe from here and save it to your desktop:
   
   SmitFraudFix.exe
2. Confirm that the file SmitfraudFix.exe now resides on your desktop, but do not double-click on the icon as of yet. We will use it in later steps. The icon will look like the one below:
   
   
   
   Next, please reboot your computer into Safe Mode by doing the following:
3. 1. Restart your computer
      
      After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
      
      Instead of Windows loading as normal, a menu should appear
      
      Select the first option, to run Windows in Safe Mode.
   2. When you are at the logon prompt, log in as the same user which you had done the previous steps.
   When your computer has started in safe mode and you see the desktop.
   Close all open Windows.
   
   Now, double-click on the SmitFraudfix icon that should be residing on your desktop.The icon will look like the one below:
   
   
   
   When the tool first starts you will see a credits screen. Simply press any key on your keyboard to get to the next screen.
   
   You will now see a menu as shown in the image below. Press the number 2 on your keyboard and the press the enter key to choose the option Clean (safe mode recommended).
   
   
   
   
   The program will start cleaning your computer and go through a series of cleanup processes. When it is done, it will automatically start the Disk Cleanup program as shown by the image below.
   
   
   
   
   
   This program will remove all Temp, Temporary Internet Files, and other files that may be leftover files from this infection. This process can take up to a few hours depending on your computer, so please be patient. When it is complete, it will close automatically and you will should continue with step 11.
   
   When Disk Cleanup is finished, you will be presented with an option asking Do you want to clean the registry ? (y/n). At this screen you should press the Y button on your keyboard and then press the enter key.
   
   
   When this last routine is finished, you will be presented with a red screen stating Computer will reboot now. Close all applications. You should now press the spacebar on your computer. A counter will appear stating that the computer will reboot in 15 seconds. Do not cancel this countdown and allow your computer to reboot.
   
4. Once the computer has rebooted, you will be presented with a Notepad screen containing a log of all the files removed from your computer. Examine this log, and when you are done, close the Notepad screen.

Your computer should now be free of the SmitFraud infection.

sourced from here

http://www.bleepingcomputer.com/forums/topic17258.html

Browntoa

then go back into safe mode and scan with Windows defender and then Avg anti spyware

doorstep

Thank you so much Browntoa - i'll give it a go!!

Oh and i've sorted out my modem problem (I uninstalled and re-installed) and everything is now working fine

doorstep

doorstep

Would you believe it - it's still there...!

I think my computer is beyond help...