Trojan Horse problems

[jmck66]

I've been infected! I ran AVG (free edition) and it detected 7 Trojan Horses. But they keep coming back. After looking up on the internet I downloaded Adaware07 and ran that (with system restore turned off) it seemed to detect more stuff including the Trojan Horses. I'm not sure whether to keep Adaware on my system or not. I don't think I could run AVG and Adaware at the same time can I? (I also have with AVG, zone alarm and spybot search and destroy). These Trojan Horses still seem to be there. Is there 'anything' I can do to get rid of these things? I use Windows XP and I've got a feeling it's going to take up most of my weekend! One more thing, each time I start up my computer I get the message box 'Windows Defender Service failed to initialize' - is this because I'm running AVG? Any help would be appreciated. Thanks

[Ethel]

Firstly, there is no problem running AdAware with AVG. I assume you mean the free AdAware from Lavasoft?

Now there are 2 AVGs - one is AVG anti-virus which puts an icon in your task bar and is continually running. The other is anti-spyware and used to be called Ewido. It would be helpful to know which AVG you are referrring to.

What is AVG doing with the trojan horses it detects? If it is putting them in the virus vault are you emptying the vault?

I suggest you reboot in safe mode, with system restore turned off, and run all your anti-spyware again - spybot, AdAware and so on.

I also like another free program (I am very belt and braces) called A2. It may be worth downloading first and running in safe mode:

http://www.emsisoft.com/en/software/free/

[vehelpfulguy]

First things first.

AVG is an anti virus program and it is not a good idea to run more than one anti virus program. From your list of programs I dont think any are anti virus programs so you are OK there.

With AVG you MUST make sure you download the latest updates each day and you MUST run a full scan on a regular basis (daily?).

Adaware is NOT an anti-virus programs it is a spyware program. With adaware you need to download the updates yourself AND run the scan yourself.

There is no problem having AVG and Adaware on your PC at the same time.

Zone Alarm is a firewall and there is no problem having Zone Alarm running as well as AVG and Adaware. If you have Zone Alarm make sure the WINDOWS firewall is off (see security centre).

Spybot is like Adaware, it is a spyware program.

You may be getting the Defender problem because you have the Beta version and that ran out on December 31st.

With all your other security programs I would delete Defender, it has not had very good reviews anyway.

Considering you have all this security I am amazed you have 7 trojan horses. Are they perhaps coming in via attachements to your e-mails ?

Make sure the AVG e-mail scanning is on.

When you run AVG this should give you the choice to remove the trojan horses, but it seems you are doing that.

Some "clever" programs can detect if they have been uninstalled and can re-install themelves using a file hidden on your computer somewhere.

These are difficult to remove.

[vehelpfulguy]

One suggestion.

Go into zone alarm, and choose "program control" then "programs" tab.

This gives you a list of all the programs that have permssion to access the internet.

Go down the list and delete ALL the programs.You can use Ctrl and shift to select a whole block to delete.

Now turn your PC off and back on again.

Now, as each program tries to access the internet you will get a message from zone alarm asking if that is OK.

Some are fine (Internet Explorer, Generic Host Process etc)
and you can OK them.

But some may NOT be fine and may be the trojan programs.

Make a note of each program (and directory) that tries to access the internet and if you are CERTAIN that it is a trojan then go to the folder where the file is and delete it.

If you are not sure, then leave it.

That way you may get rid of all the trojans.

[jmck66]

I use the Free edition of AVG Anti-Virus, Ethel. Will try all your suggestions, hopefully that will do the trick.

I already get a box with zone alarm messages in and I will check for any updated versions of Spybot, vehelpfulguy.

Thanks for all your help, and so early in the day!!! I might get a weekend after all. xx

[Ethel]

Let us know how you get on - there is more ammunition and tricks to be tried.

[jmck66]

Well, it's the end of a long day!! I think they're still there... I've run A2, Adaware, Spybot and am just running AVG in safe mode (although AVG is telling me that Resident Shield is not loaded - would that be something to do with the fact that I'm in safe mode?). Anyway, Spybot has detected Virtumonde in several executable files (incl system32) and said that it couldn't delete them because they were being used and would get rid when windows starts up again. I think I've had that message before. These items are in the recovery part of spybot and I don't know if I can 'Purge' selected items or not. I'm sorry about this I'm feeling a bit of a failure - I was so up for it first thing this morning, I was sure I was going to beat this thing.. Oh, by the way Ethel, when AVG previously detected the trojon horses, they were put in the virus vault and yes, I did delete them..Have a nice evening.

[Ethel]

AdAware should get rid of virtumonde.

How disappointing.

You rebooted in safe mode and ran all the programs and the trojans are still there?

Any idea what these trojans are?