• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 359
  • Last Modified:

Autoloading Trojan in Registry - NEED to DESTROY!

I'm really tired of these types of infestations. My 13 yr old goes to music & lyrics sites and twice has had an opportunistic trojan affect my PC.

On W2k, use AVG, SPYbot, & ATS(bought after the last time this happened)-all up to date and used as daily scans.

No real problem getting these softwares to do what they were designed to do (multiple checks until is says no viruses found)  BUT I have no idea how to determine what the autoloading registry value change was that allows the reloading of this trojan every time I go back on the internet.

As soon as I reconnect to IE, AVG immediately pops up with Trojan Found -Downloader.small.4.BQ found in CS4PO28.exe and/or start page viruses. Then of course it multiplies with all these other viruses and wanna download popups.  

I have deleted all the Temp files, searched for all executables created within the last 24 hrs. and deleted them. I'm a novice when it comes to changing registry values, but because of the last trojan, I did go to regedit and searched HK_LM to see if the stcloader.exe files somehow found its way back on my system(result: not found). Maybe its a different .exe file this time?
 
Anyone have any ideas on what else I need to delete to get this system back to normal. AND other than the obvious (not to let the 13 yr. old back on the PC) how I can prevent future opportunistic trojans from attacking my PC.

Comment: I really don't get it. Why do people write this malicious code? I'ts such a pain in the A-- for everybody.  
I really appreciate the help I've found here at experts-exchange and want to thank and commend all who contribute answers to help us try to deal with our IT issues.

DMoreland
0
Diane_Moreland
Asked:
Diane_Moreland
2 Solutions
 
sunray_2003Commented:
Hey

I would surely advise you to check other spyware tools to start with.
http:Q_20945897.html

Check these online virus scanners and see if they all report the same trojan/virus

http://vil.nai.com/vil/stinger/

http://housecall.trendmicro.com/ 

http://security.symantec.com/

Then use a pop-up blocker

*************
http://home.rochester.rr.com/artcfox/Pop-Down/

http://www.panicware.com/product_psfree.html

http://zdnet.search.com/search?channel=56&cat=279tag=st.zd.sr.srch.zdnet&q=popup+killer

http://12ghosts.com/ghosts/popup.htm
*************

download this tool http://www.techadvice.com/win2000/m/msconfig_w2k.htm
install it
go to start --> run ---> msconfig
go to startup tab
disable all applications. reboot the machine and check if the virus/trojan comes back again.
If not , enable one by one and check if there is any application might be causing this download of trojan

Post back doing all these.
0
 
mclean01Commented:
What was the name of the trojan?
0
 
RevelationCSCommented:
i believe this is the virus if I read your post correctly-

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SMALL.HB

it should have all of the directions needed to clean the system properly of the virus... also, if you verify with http://housecall.trendmicro.com/  the name of the virus, just to make sure, you should be able to right click on the found virus in the online scanner and pull up the documentation if it shows as anything other than the virus that is listed here...

hope this helps...
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now