need help-- trojware.win32 on xp

Big red · 26 Dec 2011 at 10:55

hi guys my daughter has a system with xp on it yesterday after loading a csi game and a new version of direct x it has slowed down and commodo has found the trojan win32 file .malwarebytes tries and has limited success it still finds them iv tried to remove it without a result, the problem is we need to remove it without formating as all her degree work is on it . iv done a system restore also but it is still there is there any software remover that works ,any help would be welcome

Destination · 26 Dec 2011 at 11:01

Turn off system restore, delete old copies
Then log to safe mode, run you fully updated mbw
Then reboot and run mwb again

Hopefully this will clean it properly

Hagar · 26 Dec 2011 at 11:15

Try MoveOnBoot to delete the files properly as the machine reboots and before it gets to windows. Then run malwarebytes again.

Big red · 26 Dec 2011 at 11:41

thanks guys will give i a try

Big red · 26 Dec 2011 at 21:52

looks like it didn't work tried other Trojan removers and other anti virus but it does not folly remove it and when you try to go on line to a security web site it stops you via ie from getting on line any other site and we are OK , it is looking like a full format is required :eek:

maj · 26 Dec 2011 at 22:43

If you can access it, you could give Dr Web a go.

As for not getting on certain websites, could be that the trojan has modified your hosts file. When you get denied access to security websites, what appears on your screen?

Hagar · 26 Dec 2011 at 23:28

boot up with a linux dvd like ubuntu to save her work. should also be unaffected by the trojan for web site access.

PapaLazaru · 27 Dec 2011 at 00:48

Run rkill and see if anything shows up.

mystes · 27 Dec 2011 at 01:08

Big red said:
looks like it didn't work tried other Trojan removers and other anti virus but it does not folly remove it and when you try to go on line to a security web site it stops you via ie from getting on line any other site and we are OK , it is looking like a full format is required

Are you sure this is trojan? For me its look like some sort of adware software, which try to make you to purchase their copies of program to remove 'Virus' on yours daughter pc. Try to type msconfig in run (start menu). Go to startup tab and look for some weird entries. It does usually the trick, but you will have to use safe mode to remove it. Friend of mine have something like this before and I manage to remove it without performing a full format.

Big red · 27 Dec 2011 at 14:30

looks like i may have licked it i will give it a few days i tried Dr web and that seemed to kill it and along with malwarebytes got 0 virus/Trojan detected and the PC seems to be running faster and i was able to load a new anti virus programme and update it OK , so as i say i will give it a few days and see what happens