Another Trojan.gen.2 problem - quarantined, but keeps coming back

kauman · ‎07-03-2012

I'm hoping someone can help me. I'm using Windows 7 Home Premium (64-bit) and Symantec keeps finding, blocking and quarantining Trojan.gen.2 but it keeps coming back.

Following Symantec's recommendation, I tried the Norton Eraser. It came back and said it cleaned everything (I've forgotten what it said was wrong and can't find a long?), but upon reboot there was the Trojan.gen.2 again.

As an added bonus, the whole process of detecting and stopping this malware seems to bring my whole system to a crawl -- so that it's unusable. For example, hit Cntrl-Alt-Del to bring up the Task Manager (to kill an app or process) and it can take 5-10 minutes for it to recognize those keystrokes. Mostly, I just force a hard power down and reboot.

As you can imagine, this whole thing is pretty frustrating. Any help would be most welcome as I'm about to toss this laptop out the window!

dickevans · ‎04-08-2008

kauman wrote:
I'm hoping someone can help me. I'm using Windows 7 Home Premium (64-bit) and Symantec keeps finding, blocking and quarantining Trojan.gen.2 but it keeps coming back.

Following Symantec's recommendation, I tried the Norton Eraser. It came back and said it cleaned everything (I've forgotten what it said was wrong and can't find a long?), but upon reboot there was the Trojan.gen.2 again.

As an added bonus, the whole process of detecting and stopping this malware seems to bring my whole system to a crawl -- so that it's unusable. For example, hit Cntrl-Alt-Del to bring up the Task Manager (to kill an app or process) and it can take 5-10 minutes for it to recognize those keystrokes. Mostly, I just force a hard power down and reboot.

As you can imagine, this whole thing is pretty frustrating. Any help would be most welcome as I'm about to toss this laptop out the window!

Welcome,

Please don't toss the laptop out the window, it will not improve its performance and it could hinder someone elses.

The person you need to work with is Quads. He's another volunteer here and very good at what he does. Because he's good and VERY busy helping others he insists that you follow his instructions to the letter and do not attempt to 'fix' things on your own.

Please be patient and he will find your message and respond.

Dick
Win7x64 SP1 current NIS V20

Quads · ‎07-21-2008

ANY other user other than the thread starter is not to use any instructions, scripts or proceedures, The work though in cleaning a system is individual and only for that system due to a number of factors.

Please do not run any tools unless instructed to do so.

We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability. Do as the instructions ask nothing extra or run things twice
If I ask a Question just answer it, don't run anything unless it states.
Major steps used:

1. Find

2. Break

3. Destroy

4. Cleanup (including system as a whole)

Please read every post completely before doing anything.

Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.

Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forum, (sometimes )
Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.

Do you have a Flash Drive??

Quads

IanTheGreat · ‎07-01-2012

Have you deleted your restore points ?

Only The Strong Survive , By Being Wise With No Compromise

Quads · ‎07-21-2008

IanTheGreat wrote:
Have you deleted your restore points ?

OK guys we have a user that has no idea about how zeroaccess works and how it can effect Windows or netsvcs etc. System Restore doesn't work or gets Stuck, including system restore getting in a loop via Startup repair.

So don't follow info like this, there is a time and place for System Restore, sometimes after the removal.

Why don't you infect you system with all the variants of zeroaccess and find out.

Quads

f-arn · ‎08-16-2009

You do not delete System restore points, until the System is clean.

Better to restore an infektion, than to have no system at all.

Quads · ‎07-21-2008

Oh hahahaha I get more abuse, the user must be angry that he has been told system restore doesn't work with zeroaccess variants and doesn't like it.

I have notified the people that create our tools of the newest change with zeroaccess that does show.

I infect my system with the likes of zeroaccess all the time so I know what changes and what works or doesn't.

Users would prefer a guy trained in this area that one that is Not.

f-arn

You are correct, but the advanced malware can rebuild itself including sometimes using system restore or the fact some malware it's not a good idea to use system restore at all until broken, or System Restore is broken.

Quads