Help needed to remove Trojan horse patched_c.LYU

waddler_8

Open Task Manager (Ctrl+Shift+Esc)

You'll see *.3XE processes running under Image Name and there will be fluctuations in CPU usage from them if combofix is still running. It may be that combofix is still searching for files.

If we're still having problems we may be getting to the point where it may be better to back up your personal files and reinstall windows or take it back to factory settings.

I'm going out for lunch myself now but will be on later.

kellyp

In task manager there are no .3xe processes showing. I still dont have a desktop (or a windows bar) and the blue dos screen that was showing the combofix details has now disappeared. Reinstalling windows will be troublesome as its a netbook with no disk drive. I tried to back up when initially had the netbook, but it wouldnt do it without a CD (!) and gave up with it. I do have a backup CD for my desktop, which I could copy info over to a flash drive.

Figment

Your netbook should have a factory restore partition. What's the full model number?

Factory restore will wipe all of your data. Do you have a backup?

kellyp

Nothing of major importance on it, and crucial things already on a memeory stick.
It a Samsung N210 plus (also stated on back as NP-NP210-JP02UK. S/N: ZSSX93LZ702561X
There is a Windows 7 Starter product key on their too.
I have just had to reboot system to be able to do anything, and I've tried to uninstall combofix but it has frozen during the process (can still perform other tasks around this however so the computer hasnt frozen as such, just the uninstall process has frozen)

Figment

If you wish to go ahead with a factory restore, restart the netbook and press the F4 key as soon as the first screen appears.

kellyp

combofix has apparently uninstalled itself now (after a reboot on its own). Just going to rtun malaware again now, and not sure whether I should try a combofix download again

kellyp

If I go for a factory restore, presumably I dont lose windows?

Figment

kellyp wrote: »

If I go for a factory restore, presumably I dont lose windows?

Correct, but you will lose anything you've installed on it since you purchased it. It resets the netbook to how it was when first taken out of the box.

After restoring, you will need to set up your wifi again, remove any trial software you don't want/need, install anti-virus, and run Windows Update to get Windows back up to date.

Figment

http://skp.samsungcsportal.com/integrated/popup/FaqDetailPopup3.jsp?cdsite=uk&seq=405123

kellyp

OK I've just run malaware again and there is nothing there - does this mean I've cured it?! (when I say me I mean you waddler_8 and figment!)

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 194970
Time elapsed: 8 minute(s), 11 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)


Going to do an AVG scan again now and keeping my fingers crossed