computer has a bad trojan

waddler_8

Do you remember the name of the trojan MSE detected at all? Did it mention Alureon?

spaceboy

Honestly cant remember, I was expecting MSE to remove it, so wasnt paying much attention. I remember it was classed as "severe" though. All I remember is win32 something...

david.robinson_2

Boot in safe mode with networking by pressing either f8 or f12 just before the windows logo appears, if safe mode with networking appears on the startup repair screen choose it and press enter. This should boot windows from here you can either backup your data and wipe or get rid of the virus and carry on as normal.

Next download this Rkill from bleepingcomputer (I cant post links due to being new but google rkill.exe download) should be from bleepingcomputer.com

Next download malwarebytes anti-malware and install it.

Run Rkill.exe that will stop all unknown processes in windows and in most cases stop the virus from running. Wait until the command window closes and then run Malwarebytes, if it asks you to update do so it's very important.

Perform a full scan on your computer and once its completed show results and remove the viruses it has found. This should definately get rid of the virus at least.

Restart the computer and it should boot into windows. If it still goes to startup repair and can't fix the error boot into windows using safe mode with networking and perform a system restore. If for some reason you can't boot with safe mode then get back to me by pm.

Hope this helps!

lee20010

Funny you say that David, I always remove in safe mode without internet access, as most trojans, adware etc often re-download on removal...annoying as hell

david.robinson_2

ah but you cant update the antivirus without internet access and its important its updated because if its a new virus then it won't remove it. Rkill.exe stops all viruses processes allowing the antivirus software to do its job. I suppose you could restart after updating the software though good point.

waddler_8

david.robinson wrote: »

If for some reason you can't boot with safe mode then get back to me by pm.

Why not keep the advice in this thread?

david.robinson_2

fair enough just thought pm might be easier to work with. So far he tried to boot with safe mode and it still fails. I shall get back to this thread very soon.

spaceboy

I've currently running the avira rescue disc, will report back findings soon...

spaceboy

First detection - signature of java script virus JS/Redirector.QB

in Firefox profiles setup.

spaceboy

TR/FakeAV.AH - Trojan Horse