Need help with torjan horses
- Thread starter 5starGeneralAlphaSnake
- Start date
- Joined
- Nov 7, 2008
- Messages
- 4,560
I'm curious how you came to recognize you have trojan horses on your PC. You must have some security software which alerted you right? The same software should be able to identify and remove the files identified as trojans.
The problem with trojan horses - the really good ones - is that they can be polymorphic. In other words, they can change. All of the anti-malware programs listed so far in this thread are primarily signature based. They only sound an alarm when a specific sequence of a file matches a pre-identified sequence in their database.
If the trojan horse changes enough so it doesn't match the database signature, the anti-malware program will not sound an alarm. That's why other steps, such as using more heuristic based programs and just avoiding actions which lead to trojan infection - are so important.
Steps To Take
1. If your PC is really infected and if you already have good clean back-ups, I'd wholly endorse what other people say - to reformat. But, a simple reformat of the hard drive is NOT enough. Any partitions on the drive should be deleted/destroyed and the entire disk scrubbed with a program such as DBAN. There are several low-level trojans which can survive a high-level format by residing in protected areas of the partition.
**Note: A common misperception is that a format is the best way to "erase" a hard drive. Not true!
Once the drive is scrubbed, reformat it via a low-level (read: not fast) format and reinstall the OS and your files. **Reinstall from known CLEAN media. You said you made a back-up but there are good odds your back-up is also infected.
2. Let's say you can't erase/reformat your hard drive, and you need to try and recover it. The next suggestion I would have is to create, on a known clean computer, some bootable media based on Linux. The favorite, of course, is Ubuntu. Get the Ubuntu software, burn to a disk, and boot the infected computer from the CD. Then, using the anti-virus and anti-malware programs resident on the disk or which you can download from the apt repository, sweep the infected hard drives as much as possible.
Once that's done, then boot the infected PC back to Windows, and run your favorite anti-virus and anti-malware programs. Several have been listed in this thread, they are all more-or-less pretty good with their own pros and cons.
The on-line scanner is a good idea since it will likely have the most up-to-date signatures.
3. Once your PC is back up, there are three programs which I highly recommend/strongly suggest you run. They are:
RootKit Revealer
This program will attempt to identify any rootkits which are resident in any programs. Identification of a rootkit, IMHO, means your PC is severely infected and any and all files on the PC are suspect.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
AutoRuns
This program, when run, will show all of the running processes and programs on your PC. You should try to identify and recognize all processes and programs. If there are ones which you don't recognize, Google them or examine them in more detail. If you still can't identify them, there's a good chance you still have a trojan on your PC.
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
HijackThis
You should also run this program and check to see what it lists. See if it flags anything, if it does - that's bad. If it doesn't, read through the list, line-by-line, and again check to see that everything which runs either checks out on Google or is something you recognize and want to run. You can post the Hijack this log here if you want other people to look at it.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
Good luck!
PS: Remember your suspect PC is possibly infected! No logging on to email, IM, Steam, school or bank accounts, VoIP, or anything. You do not know what the trojan (if there is one) is capturing or looking to do.
Edit:
Have you tried running Microsoft Windows Defender yet? People mock Microsoft, but Windows Defender is actually one of the best anti-malware programs (Microsoft bought the original company). What does Defender say?
The problem with trojan horses - the really good ones - is that they can be polymorphic. In other words, they can change. All of the anti-malware programs listed so far in this thread are primarily signature based. They only sound an alarm when a specific sequence of a file matches a pre-identified sequence in their database.
If the trojan horse changes enough so it doesn't match the database signature, the anti-malware program will not sound an alarm. That's why other steps, such as using more heuristic based programs and just avoiding actions which lead to trojan infection - are so important.
Steps To Take
1. If your PC is really infected and if you already have good clean back-ups, I'd wholly endorse what other people say - to reformat. But, a simple reformat of the hard drive is NOT enough. Any partitions on the drive should be deleted/destroyed and the entire disk scrubbed with a program such as DBAN. There are several low-level trojans which can survive a high-level format by residing in protected areas of the partition.
**Note: A common misperception is that a format is the best way to "erase" a hard drive. Not true!
Once the drive is scrubbed, reformat it via a low-level (read: not fast) format and reinstall the OS and your files. **Reinstall from known CLEAN media. You said you made a back-up but there are good odds your back-up is also infected.
2. Let's say you can't erase/reformat your hard drive, and you need to try and recover it. The next suggestion I would have is to create, on a known clean computer, some bootable media based on Linux. The favorite, of course, is Ubuntu. Get the Ubuntu software, burn to a disk, and boot the infected computer from the CD. Then, using the anti-virus and anti-malware programs resident on the disk or which you can download from the apt repository, sweep the infected hard drives as much as possible.
Once that's done, then boot the infected PC back to Windows, and run your favorite anti-virus and anti-malware programs. Several have been listed in this thread, they are all more-or-less pretty good with their own pros and cons.
The on-line scanner is a good idea since it will likely have the most up-to-date signatures.
3. Once your PC is back up, there are three programs which I highly recommend/strongly suggest you run. They are:
RootKit Revealer
This program will attempt to identify any rootkits which are resident in any programs. Identification of a rootkit, IMHO, means your PC is severely infected and any and all files on the PC are suspect.
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
AutoRuns
This program, when run, will show all of the running processes and programs on your PC. You should try to identify and recognize all processes and programs. If there are ones which you don't recognize, Google them or examine them in more detail. If you still can't identify them, there's a good chance you still have a trojan on your PC.
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
HijackThis
You should also run this program and check to see what it lists. See if it flags anything, if it does - that's bad. If it doesn't, read through the list, line-by-line, and again check to see that everything which runs either checks out on Google or is something you recognize and want to run. You can post the Hijack this log here if you want other people to look at it.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
Good luck!
PS: Remember your suspect PC is possibly infected! No logging on to email, IM, Steam, school or bank accounts, VoIP, or anything. You do not know what the trojan (if there is one) is capturing or looking to do.
Edit:
Have you tried running Microsoft Windows Defender yet? People mock Microsoft, but Windows Defender is actually one of the best anti-malware programs (Microsoft bought the original company). What does Defender say?
Last edited:
Hey go download and install this Trend Micro Internet Security Pro for your OS using this link
http://www.trendmicro.com/download/product.asp?productid=80
update and do a full scan. You can run for 30 days on the trial, and it is full featured. I can get you a product key next time your online. I have several copies at home that have not been opened.
http://www.trendmicro.com/download/product.asp?productid=80
update and do a full scan. You can run for 30 days on the trial, and it is full featured. I can get you a product key next time your online. I have several copies at home that have not been opened.
I'm just saying, if he can't find someone to do it or do it himself then he may need a whole new hard drive.
