Help I Have A Trojan

[iloveglee]

I have apparently picked up a Trojan, according to my anti virus protection - they have found it put cant get rid of it - oh unless I buy their virus remover for about £68!! they evidently have some dowloadable fixes for Trojans but they wont download because it keeps telling me what I am trying to download contains a virus!! I know Trojans are not viruses - this is called zeroaccess.hi and something about desktop. does anyone out there (I am sure there is somebody out there), know how problematic this is, what is it likely to do and how can I get rid of it.

[whistonian]

Which anti virus are you using,sounds more like a sales gimic to me.

[chrisgel]

Information here.
http://spyware.scanspyware.net/spyware-removal/rootkit.zeroaccess.h.html

[SlackAlice]

More details on your pc please? What O/S are you running and is it up to date? What anti virus program do you have?

In the meantime download and install the free version of Malwarebytes
http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

Then restart your pc into safe mode and run a scan using Malawarebytes.

[jno]

I agree with whistonian. Is this warning definitely from the anti-virus system you have installed, or is it a scam from some pop-up?

[VHG]

Some rogue anti virus or security software PRETENDS you have a virus or Trojan or other problem on your computer just to get you to pay them some money.

DONT PAY ANYONE ANY MONEY.

Download the free version of Malwarebytes and run that.

http://www.malwarebytes.org/

Note you may need to run a number of different malware products to get rid of it so don't worry about that.

p.s. If it is a rootkit that can be very nasty and difficult to get rid of.

Just to be on the safe side I would back up all your personal files to an external hard drive NOW, just in case it results in a reinstall of Windows.

[iloveglee]

yes I've read these things about telling you that you have viruses etc just to make you buy stuff, and NOT to buy. however, and I do recognise that there is stuff out there, free and downloadable but one of the problems is that I simply cannot download anything at all. I can't download pdf files nor can I download attachments to e-mails, even though I know they are from reliable sources. I also keep getting this alert from mcafee to say my computer is at risk and the firewall is off. so I put it back on and then a little bit later it is off again. it really is off, not just an alert saying so. on the other hand the status is not now showing that I have this Trojan. I just don't know what is going on. I have windows 7 64 bit, the computer is only two years old and I allow all the updates that come so should be up to date. as mentioned, the anti-virus is mcafee, I get it free via my bank.

[chrisgel]

If you read the article I linked to you will see that one of the properties of zeroaccess.hi is to prevent you running anti virus programs and also to prevent you using on-line anti virus sites. So it's doing what it was designed for.
Here is another site that might help if you can get on to it.
http://blog.teesupport.com/how-to-completley-remove-zeroaccess-hi-trojan-from-desktop-ini-manual-removal-guides/

[Alston]

chrisgel....I regret having to say it, but both the links which you have given are being identified by my WOT (Web of Trust...Firefox add-on) as being sites with very poor reputations.

iloveglee...You do have a Trojan. Do your best to download and run Malwarebytes and tell us the outcome as soon as possible.

Al.

[chrisgel]

Alston - Thank you for the warning. I have now installed WOT and will give it a go.

[Alston]

iloveglee.......What's the latest which you are able to report.?

Al.

[iloveglee]

In the end absolutely nothing worked, mcafee were useless and I had to do a full system restore back to factory settings. Luckily nothing that I couldn't bear to lose or couldn't get back. All personal stuff put onto memory stick and used iPad to reset all bank and credit card passwords etc. i have a note of user names etc. well worth doing it took ages but now running better than it has done for ages which begs the question how long has this thing been there without mcafee noticing. Won't use it again but really don't know what to use now. Has Microsoft security essentials for the minute but unsure if there is anything better - free out there. Been recommended avg but used it before and really slowed things up. Also avast???

[Alston]

Thanks iloveglee for having responded promptly to my enquiry.

I honestly Do Not think that one can do any better than having MSE as a virus protection programme. The topmost Techie members in Answerbank advocate it as the best free AV programme which is as good as purchased items. I would even go as far as saying that anyone who thinks otherwise and purchases an AV programme, has more money than sense.:-)

MSE does work away in the background and I have always taken the view that Microsoft should know how to keep windows clean.

So you've taken everything back to factory settings. Not a quick process, is it.? I know from having done that with a Dell Laptop which I then passed to my niece. It took hours and hours just to download all of the Windows Up-dates.......two hundred and something of them.

Anyway, it's good to know that you are back in business and, it really goes without saying, that, for any further problems, there will be more knowledgeable folk than myself in AB to help out on matters.

Best wishes....Al.

[jake-the-peg]

It's a rootkit - meaning that it hooks in at a very low level in the operating system so if your AV is'n't up to date enough to stop it getting in it's very difficult to remove it because it has privilledge over Anti-virus and can pretend to be part of the operating system.

When the AV tries to look at it the rootkit shows it the original file

Here are some instructions posted but they are 6 months old so no guarantee it'll remove this particular varient but worth a try

http://malwaretips.com/blogs/remove-zeroaccess-rootkit/

[iloveglee]

No problem . I am, as always, grateful to answerbank members for their input. I almost invariably get sensible advice/suggestions. One other thing though, i did the system restore using part of the hard drive set aside for such an eventuality, didnt need any recovery discs. having done that, is this bit of the hard drive still there with its necessary information for the event that this has to be done again (hope not). I am considering making a mirror copy but not sure if this would be necessary. I am going to stick with mse, having read some reviews online it does come out very positvely, especially with rootkit problems. not that i pretend to know what a rootkit is, but i know what a trojan horse is having read greek history!! this is the first time i have had this kind of problem, no way of knowing i dont suppose where it is likely to have come from.