topic Re: Help with Trogen.gen.2 in Norton 360

Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 04:23:16 GMT

I've tried several scanners (to absolutely no avail) and I've read several forum posts but I just don't have the skill base to remove this thing. I do know that I need OTL, but I have no idea what to do with it. Can anyone help me remove this bad boy? I'll even pay for it (if that's possible)...

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 04:26:39 GMT

Not sure if this info helps...

Category: Resolved Security Risks Date & Time,Risk,Activity,Status,Recommended Action,Path - Filename 5/19/2012 9:19 PM,High,80000000.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 9:19 PM,High,800000cb.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 9:11 PM,High,800000cb.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 9:11 PM,High,80000000.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 9:07 PM,High,800000cb.@ (Trojan.Gen.2) detected by Auto-Protect,Quarantined,Resolved - No Action Required,c:\windows\installer\{7faaaafa-cf14-2f74-3593-878a94dc601b}\u\800000cb.@ 5/19/2012 8:08 PM,High,800000cb.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 8:08 PM,High,80000000.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 8:00 PM,High,800000cb.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 8:00 PM,High,80000000.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 7:51 PM,High,80000000.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 7:51 PM,High,800000cb.@ (Trojan.Gen.2) detected by Auto-Protect,Blocked,Resolved - No Action Required, 5/19/2012 7:47 PM,High,80000000.@ (Trojan.Gen.2) detected by Auto-Protect,Quarantined,Resolved - No Action Required,c:\windows\installer\{7faaaafa-cf14-2f74-3593-878a94dc601b}\u\80000000.@

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 04:35:44 GMT

What is your Operating system??

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 04:36:39 GMT

Vista 32-bit SP2

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 04:48:28 GMT

Found he 2 folder locations

C:\Users\[username]\AppData\Local\{7faaaafa-cf14-2f74-3593-878a94dc601b}
C:\Windows\Installer\{7faaaafa-cf14-2f74-3593-878a94dc601b}

Can you find them?? You probably won't be able to manually delete the folders.

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 04:56:20 GMT

I was able to find:

C:\Windows\Installer\{7faaaafa-cf14-2f74-3593-878a94dc601b}

Should I attempt to delete it?

Thank you so much btw. Do you take donations or anything for your help?

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 05:02:15 GMT

You may have to change the folder options to show Hidden files and folders and show protected system files to find the other folder.

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 05:05:31 GMT

Oh, I found it now!

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 05:10:41 GMT

Is it exactly as I typed it out above?? for the folder names and the locations.

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 05:12:50 GMT

Actually yes. It's a perfect match.

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 05:31:55 GMT

What was the user account name that one of the folders was located in??

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 05:34:23 GMT

Moraga

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 05:42:40 GMT

Please read carefully

We may yet have to do this with a program without Windows loading as something is Blocking Programs from running etc. But we will try and log with this,

a) Download OTL hxxp://oldtimer.geekstogo.com/OTL.exe (change the hxxp to http) save it to your Desktop.

under Copy and paste the custom script attached which you open in for instance Notepad,(include the : at the start of :OTL and all the way to the end / bottom) and run the script. (Red Run Fix Button)

The output log, should be placed in the C:\ _OTL folder after.

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 06:27:49 GMT

Seems to be working! Thank you so much!

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 06:40:45 GMT

Where is the log of what it did??

Do you want the rest of the system checked for leftovers etc??

Quads

Re: Help with Trogen.gen.2

snowcomm — Sun, 20 May 2012 06:50:12 GMT

Sorry, here's the log. And yes, I'd like to know how to check the rest of my system. Thank you.

Re: Help with Trogen.gen.2

Quads — Sun, 20 May 2012 07:07:51 GMT

Malwarebytes Free has had it's definitions updated to or should detect the rest of the registry entries.

Download the Free version http://www.filehippo.com/download_malwarebytes_anti_malware/ on the upper right hand side there is a link to download the latest version.

Keep it as free after install and it will ask to update the definitions ( or use the update tab) once the definitions are installed, Run a Full Scan.

Quads

Re: Help with Trogen.gen.2

shannons — Wed, 23 May 2012 16:10:05 GMT

Moved to own thread for better exposure.