Need Help in Removing Trojan

• revolu_07

  20 Mar 07, 18:10

  Hi guys, I just downloaded AVG anti-spyware free version.
  
  It detected the following
  
  "Trojan.Steal" Risk = High
  
  Located: [1340] VM_10001000
  
  For the 1st time it was detected, I quarantined it and then I deleted it at the quarantine section.
  
  I rebooted the comp and then did a second scan. It shows this trojan.steal again. I then quarantine it. But this time round, when I went to the AVG Quarantine section, there was no infected file at all. How come?
  
  How do I remove it?
  
• ndmmxiaomayi

  20 Mar 07, 19:05

  Did you save a report?
  
  Can you post the whole report here?
• revolu_07

  21 Mar 07, 16:49

  Originally posted by ndmmxiaomayi:

  Did you save a report?
  
  Can you post the whole report here?

  AVG Anti-Spyware - Scan Report
  ---------------------------------------------------------
  
  + Created at: 3:57:27 PM 3/21/2007
  
  + Scan result:
  
  C:\System Volume Information\_restore{212FBE8A-C94F-446F-B2F1-6FB4BC8EBFE2}\RP182\A0181671.exe -> Downloader.Small.eig : No action taken.
  C:\System Volume Information\_restore{212FBE8A-C94F-446F-B2F1-6FB4BC8EBFE2}\RP182\A0181672.exe -> Downloader.Small.eig : No action taken.
  [1356] VM_10001000 -> Trojan.Steal : No action taken.
  
  ::Report end
  
  Report as above. I have put them in quarantined. However, each time i reboot and scan, the same ting shows again..
  
  Why is that so?
  
  For the Trojan.Steal, it's even more strange. I scanned then quarantined. However, in the 'quarantined' section, i only saw the downloader trojan and not the 'Trojan steal' . Strange..
  
  Need your help please. Thanks!
• ndmmxiaomayi

  21 Mar 07, 16:54

  Your system restore is infected, just need to clear it.
  
  Right click My Computer and select Properties.
  
  Select the System Restore tab.
  
  Tick this box: Turn off System Restore on all drives. Click Apply.
  
  When everything is being applied, untick this box. This will turn on system restore again, and will delete all previous infected system restore points.
  
  Click OK and restart your PC.
  
  Edit: forgotten an extra part.
  
  Download F-Secure Blacklight
  
  Select the Graphical user interface version. Do a scan and post the log here. Don't do anything yet.
• revolu_07

  21 Mar 07, 17:00

  Originally posted by ndmmxiaomayi:

  Your system restore is infected, just need to clear it.
  
  Right click My Computer and select Properties.
  
  Select the System Restore tab.
  
  Tick this box: Turn off System Restore on all drives. Click Apply.
  
  When everything is being applied, untick this box. This will turn on system restore again, and will delete all previous infected system restore points.
  
  Click OK and restart your PC.
  
  Edit: forgotten an extra part.
  
  Download F-Secure Blacklight
  
  Select the Graphical user interface version. Do a scan and post the log here. Don't do anything yet.

  Well man!! Thanks a lot. I will follow what you said. But what is F-secure Blacklight?
  
  Btw, does it mean that my system is affected already? Or just someting harmless?
• ndmmxiaomayi

  21 Mar 07, 17:03

  Originally posted by revolu_07:

  Well man!! Thanks a lot. I will follow what you said. But what is F-secure Blacklight?
  
  Btw, does it mean that my system is affected already? Or just someting harmless?

  F-Secure Blacklight is to scan for rootkits. Rootkits are programs that are able to hide a lot of things. Your log show signs of some infection, so need to be sure.
• revolu_07

  21 Mar 07, 17:11

  Originally posted by ndmmxiaomayi:

  F-Secure Blacklight is to scan for rootkits. Rootkits are programs that are able to hide a lot of things. Your log show signs of some infection, so need to be sure.

  I am doing the scan now. I have already done the sys restore. Later on, should i clean or don't do anyting?
  
  Thanks.
• ndmmxiaomayi

  21 Mar 07, 17:20

  Originally posted by revolu_07:

  I am doing the scan now. I have already done the sys restore. Later on, should i clean or don't do anyting?
  
  Thanks.

  Don't do anything, just exit.
  
  Blacklight will produce a log. Just need to post that log.
• revolu_07

  21 Mar 07, 17:20

  Originally posted by revolu_07:

  I am doing the scan now. I have already done the sys restore. Later on, should i clean or don't do anyting?
  
  Thanks.

  I have done the scan. It shows that nothing suspicious.
• ndmmxiaomayi

  21 Mar 07, 17:24

  Then should be OK.
• revolu_07

  21 Mar 07, 17:26

  Originally posted by ndmmxiaomayi:

  Then should be OK.

  Grateful for your kind help. So the next time i scan with avg, shouldnt show the same thing again?
  
  
• ndmmxiaomayi

  21 Mar 07, 17:27

  Originally posted by revolu_07:

  Grateful for your kind help. So the next time i scan with avg, shouldnt show the same thing again?
  
  

  Shouldn't be.
• revolu_07

  21 Mar 07, 17:32

  Originally posted by ndmmxiaomayi:

  Shouldn't be.

  Sian, just did a quick scan with AVG. It shows the 'trojan.steal' again. Dunno whether it's always shown in AVG or not.
  
  I quarantined it. But under quarantine section, see nothing. As for the downloader trojan, i do not know whether it will reappear. Cos it only shows when i do full scan.
  
  The system restore thing...do i need to reboot?
  
  
• ndmmxiaomayi

  21 Mar 07, 17:35

  Originally posted by revolu_07:

  Sian, just did a quick scan with AVG. It shows the 'trojan.steal' again. Dunno whether it's always shown in AVG or not.
  
  I quarantined it. But under quarantine section, see nothing. As for the downloader trojan, i do not know whether it will reappear. Cos it only shows when i do full scan.
  
  The system restore thing...do i need to reboot?
  
  

  Your log didn't show you quarantine. You need to click on Apply settings.
  
  You will need to reboot after doing the system restore.
• revolu_07

  21 Mar 07, 17:43

  Originally posted by ndmmxiaomayi:

  Your log didn't show you quarantine. You need to click on Apply settings.
  
  You will need to reboot after doing the system restore.

  I actually applied settings and quarantined them afterwards. I will reboot and check again.
  
  Thanks mate.