Solved

Autoloading Trojan in Registry - NEED to DESTROY!

Posted on 2004-04-24
3
343 Views
Last Modified: 2010-04-13
I'm really tired of these types of infestations. My 13 yr old goes to music & lyrics sites and twice has had an opportunistic trojan affect my PC.

On W2k, use AVG, SPYbot, & ATS(bought after the last time this happened)-all up to date and used as daily scans.

No real problem getting these softwares to do what they were designed to do (multiple checks until is says no viruses found)  BUT I have no idea how to determine what the autoloading registry value change was that allows the reloading of this trojan every time I go back on the internet.

As soon as I reconnect to IE, AVG immediately pops up with Trojan Found -Downloader.small.4.BQ found in CS4PO28.exe and/or start page viruses. Then of course it multiplies with all these other viruses and wanna download popups.  

I have deleted all the Temp files, searched for all executables created within the last 24 hrs. and deleted them. I'm a novice when it comes to changing registry values, but because of the last trojan, I did go to regedit and searched HK_LM to see if the stcloader.exe files somehow found its way back on my system(result: not found). Maybe its a different .exe file this time?
 
Anyone have any ideas on what else I need to delete to get this system back to normal. AND other than the obvious (not to let the 13 yr. old back on the PC) how I can prevent future opportunistic trojans from attacking my PC.

Comment: I really don't get it. Why do people write this malicious code? I'ts such a pain in the A-- for everybody.  
I really appreciate the help I've found here at experts-exchange and want to thank and commend all who contribute answers to help us try to deal with our IT issues.

DMoreland
0
Comment
Question by:Diane_Moreland
3 Comments
 
LVL 49

Accepted Solution

by:
sunray_2003 earned 300 total points
ID: 10907106
Hey

I would surely advise you to check other spyware tools to start with.
http:Q_20945897.html

Check these online virus scanners and see if they all report the same trojan/virus

http://vil.nai.com/vil/stinger/

http://housecall.trendmicro.com/ 

http://security.symantec.com/

Then use a pop-up blocker

*************
http://home.rochester.rr.com/artcfox/Pop-Down/

http://www.panicware.com/product_psfree.html

http://zdnet.search.com/search?channel=56&cat=279tag=st.zd.sr.srch.zdnet&q=popup+killer

http://12ghosts.com/ghosts/popup.htm
*************

download this tool http://www.techadvice.com/win2000/m/msconfig_w2k.htm
install it
go to start --> run ---> msconfig
go to startup tab
disable all applications. reboot the machine and check if the virus/trojan comes back again.
If not , enable one by one and check if there is any application might be causing this download of trojan

Post back doing all these.
0
 
LVL 1

Expert Comment

by:mclean01
ID: 10909219
What was the name of the trojan?
0
 
LVL 8

Assisted Solution

by:RevelationCS
RevelationCS earned 200 total points
ID: 10921264
i believe this is the virus if I read your post correctly-

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SMALL.HB

it should have all of the directions needed to clean the system properly of the virus... also, if you verify with http://housecall.trendmicro.com/  the name of the virus, just to make sure, you should be able to right click on the found virus in the online scanner and pull up the documentation if it shows as anything other than the virus that is listed here...

hope this helps...
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Read about the ways of improving workplace communication.
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

773 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question