topic Re: Don't know how to get rid of Trojan.Gen.2 in Norton 360

Don't know how to get rid of Trojan.Gen.2

RomanYakub — Tue, 01 May 2012 23:12:10 GMT

I have this for a week or so. Tried with simple cleaning, but then realized that it doesn't work. I have read several long instructions, and all of them are different. I use Window 7, and Norton Security Suite. Norton keeps detecting Trojan.Gen.2 every 5 minutes. Also there are all other signs of the infection: computer cannot reboot, I have to go to a restore point, browser is redirected to unwanted sites, etc.

As far as I understand, every computer should be dealt individually.

Is anyone able to help?

Thanks,

Roman

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Tue, 01 May 2012 23:57:41 GMT

What is the name of the file(s) and where were they located for detection.

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 00:35:36 GMT

Hi,

Thanks for replying!

The files are 00000002.@ and 80000064.@, 80000032.@ and located in c:\windows\assembly\temp\U

Roman

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 00:47:36 GMT

The Max++ (zeroaccess) group by the looks. Norton is deleting part of zeroaccess only, causing the rootkit not to work properly and BANG windows doesn't load properly either.

Are we talking about Windows 32 bit or 64 bit

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 00:53:01 GMT

Windows 7, 64

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 01:08:42 GMT

Please download hxxp://download.bleepingcomputer.com/farbar/FRST64.exe (change the hxxp to http) and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Choose your language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 02:07:48 GMT

It doesn't allow me to paste in into the body of the message (don't know how to disable a Spell checker).

Here is the file in the attachment

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 02:21:22 GMT

What are you playing with Virus removal for?? I can see the programs, documents and files you have downloaded or created, for instance virus removal.docx.

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 02:29:14 GMT

Well, I tried for a few days before asking for help. I had many suggestions on the Web - that resulted in downloading several programs. The file virus_removal.docx is my Word document I've created few days ago. I copied there few suggestions from the Web which included links to Malwarebytes, TDSKiller and something else. It didn't work.

I tried Malwarebytes and that Kaspersky's killer, but it couldn't reboot and started from the earlier point with all the stuff I had before.

I am posting now from another computer, on that computer I am still in System Recovery Option.

Thanks,

Roman

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 02:41:54 GMT

Download the fixlist.txt

Save it in the Flash Drive, next to FRST.exe

Run FRST as you did before, except that this time around, click on the Fix button and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

To others:-

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 02:55:06 GMT

Ok, here it is.

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 02:58:30 GMT

Windows should boot with success now. as the service and subsystems has been fixed

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 03:04:05 GMT

It does boot successfully! Does it mean I am Trojan.Gen.2 free?

Roman

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 03:31:17 GMT

Nope, but don't touch!!!!!!!!!

All I have done is got Windows to boot so I can get logs and use programs of MY choosing.

I want copies of the logs in the locations

C:\TDSSKiller...........................log.txt (3 or more of them.

and

.......................... Desktop\MB_log050112.txt"

As well as malwarebytes logs of if it deleted anything.

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 03:32:46 GMT

Of course, not! I should've known it from your previous dealings with this guy (I read them, too, there actually I learned that it should be dealt individually)

Cannot see TDSSKiller folder, only TDSSKiller_Quarantine, and there are no log files.

Malware file is MB_050112.txt, it's the latest.

SHould I run TDSSKiller and send you log files?

Thanks,

Roman

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 03:38:02 GMT

C:\TDSSKiller...........................log.txt are txt files not folders.

Don't do what I don't tell you to do.

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 03:43:56 GMT

Oops, sorry!

Here, I found them.

Thanks,

Roman

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 03:45:57 GMT

Accidently sent twice one file.

Here is the one created earlier.

There are 3 more, but they are 5KB each, I assume they were created when I opened the program but didn't run the scan.

Do you need them too?

Thanks,

Roman

Re: Don't know how to get rid of Trojan.Gen.2

Quads — Wed, 02 May 2012 03:47:49 GMT

can you use Internet Explorer??

Quads

Re: Don't know how to get rid of Trojan.Gen.2

RomanYakub — Wed, 02 May 2012 03:55:39 GMT

Ok, I am there.