viuses,

[paddy138]

i have avg anti virus on my computer, and i get a warning coming up that i have a trojan horse virus, i click the heal button and it says i have to restart my computer to heal it, so i do this and it restarts and the warning is still coming up, does anyone know how i can get rid of this, :confused:

[paddy138]

bump

[Jack]

Whats the name of the virus?

[paddy138]

trojan horse

[paddy138]

sorry full name is trojanhorsepsw.generic5.vxd

[Jack]

Assuming you're on windows, it sounds like the virus/trojan has gotten into the system restore points - so being cleaned, then restored by windows. Boot into safe mode and run the anti virus software there would be my first suggestion.

Otherwise, take a look at this (http://www.microsoft.com/windows/IE/community/columns/bugbusting.mspx) article. Gives a step by step guide on how to remove a re-occuring trojan.

[DTR-DEVIL]

Lucky u got it blocked by AVG. either u picked it up from Limewire? or any other p2p programe. or a dodgy email. People can Bind "Servers" (Which is wat opens up the back door to your computer) to anything, Pics,Mp3's,Exe's. If i was u though, Dont type no Passwords, just incase The Sneaky Little F*cker has got u Keylogged!

Best bet is to find the file and either Quaratine it or Delete.

Any props I can help, Studied it in college!

[Jack]

either u picked it up from Limewire? or any other p2p programe. or a dodgy email. People can Bind "Servers" (Which is wat opens up the back door to your computer) to anything, Pics,Mp3's,Exe's.
You didn't study very hard lol

[paddy138]

yeah my brother set up lime wire the other day, have it deleted now, how would i find the file to delete it. tried using my anti virus software but it wont work

[paddy138]

is there any way i can do it without having to do a back up on the computer,
im useless at this stuff

[DTR-DEVIL]

yeah my brother set up lime wire the other day, have it deleted now, how would i find the file to delete it. tried using my anti virus software but it wont work

Id bet money thats where u got it. First start by finding the download folder that limwire Puts all downloaded files in.

Think is C:\Doc's and Set's\YOUR USERNAME\shared\

If u havent got anything in ther u wanna keep, get rid of it all!
If not then Scan this folder using AVG. should point out wat file is infected. Then delete. go into Recycle bin and Remove all items. So it get Permertly deleted!

Excuse spelling lol

[DTR-DEVIL]

either u picked it up from Limewire? or any other p2p programe. or a dodgy email. People can Bind "Servers" (Which is wat opens up the back door to your computer) to anything, Pics,Mp3's,Exe's.


You didn't study very hard lol

Wat i said wrong? lol

[Jack]

Well, its not wrong, but its not exactly right either. Yes, you can download viruses from P2P networks and emails, but only from executable files (including zip archives). More common approach is to be pushed a file from a website, possibly a virus hidden in a .dll file.

I'm thinking the file is coming back because windows is resurrecting it from system restore on each reboot, which means its infecting a system area/file, not the shared directory.

As said, try running AVG etc in safe mode, or follow the instructions in the link I posted.

[edit] Trojans normally work by opening a port on your computer and allowing data to flow in and out - such as output from a keylogger or input in the form of a virus. A decent firewall should keep a check on your ports and stop a trojan from doing its thing.

[DTR-DEVIL]

Well, its not wrong, but its not exactly right either. Yes, you can download viruses from P2P networks and emails, but only from executable files (including zip archives). More common approach is to be pushed a file from a website, possibly a virus hidden in a .dll file.

I'm thinking the file is coming back because windows is resurrecting it from system restore on each reboot, which means its infecting a system area/file, not the shared directory.

As said, try running AVG etc in safe mode, or follow the instructions in the link I posted.

[edit] Trojans normally work by opening a port on your computer and allowing data to flow in and out - such as output from a keylogger or input in the form of a virus. A decent firewall should keep a check on your ports and stop a trojan from doing its thing.
Trojan's Dont always open the ports. Most trojans (R.A.T's) work on a Simple file that it can create which is then spread around(server). To gain access to someones computer useing a trojan. One must obtain the IP address. Most Servers that have a restart option at the startup normally hide either in System32, windows and registry. Depends how good the server is.

But then again, dont worry if u got a firewall, But do worry if the The server thats open ur ports is UNDETECTABLE.

but there only used by pro's. But i can only imagine ;)

Dont mean to change the subject but You work with computers alot Rj, u seem to know ur Sh!t,

[Jack]

Thats still a little flakey, but meh lol

[paddy138]

rite i found the exact file that is infected, its called datim.dll or something, tried deleting it but it wont let me, it say check that disk is not full or write-protected, how do i get around this

[Jack]

More common approach is to be pushed a file from a website, possibly a virus hidden in a .dll file.
Smugface :D lol

Is it datim.dll, or datime.dll? Search on google for a "clean" version of the file - there's a load of legit dll download sites. Drop it in your C:\ drive for now (for peace of mind, run AVG on that file just to ensure its clean). Reboot into safe mode, rename/move the corrupt dll, and stick the clean on in its place. Run AVG, which should pick up the trojan in the old dll, and be able to delete it properly. Reboot back into "normal" mode and run another AVG scan to make sure windows hasn't restored the corrupt dll.

[Stuart]

format and install Ubuntu :D

[Welsh Dan]

Disable system restore. Download the F-Secure 30 day trial, remove avg, install F-secure, remove the virus with that, then swap back to AVG. Then turn system restore back on.

[paddy138]

how do i turn on safe mode
and how do i disable system restore

[Iain]

format and install Ubuntu :D
Pfft!

Format and install a manly distribution of Linux. :thumb:

[Stuart]

lol such as?

and there is nowt manlier than using a CLI ONLY version ;)

[Iain]

Ubuntu comes with Gnome doesn't it? Last time I used it I wasn't a fan of the amount of graphical apps it used to do tasks. lol

I use Gentoo, installed it manually back before it had an installer. Good way to learn though as it makes you set up every part of the system and compile your own kernel etc. Then once it's installed you log in to a command line interface (until you get bored of being "hardcore" and work out how to install a desktop environment lol). :cool:

[Stuart]

no idea tbh,
I'd guess that Kubuntu has the same gui but I only had that installed for 20 mins while setting up some graphics info for the server. formatted and installed ubuntu serve cli version as its all I needed and stuff was setup immedaitely.

[Iain]

KUbuntu is the same O/S with KDE installed instead of Gnome.