• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Trojan.fakeAV removal issues

Hello everyone,

I'm new to the boards but that obviously means I have a problem also. I just want to thank you all in advance for your help as I've noticed these boards are quite resourceful and quite a few gurus seem to frequent it. 

The risk is the Trojan.fakeAV  

I've been having some trouble getting rid of this lil bugger.  I'm using NAV 2010 and though it seems to be blocking this trojan every few minutes or so there is nothing to be found in the scans. I have what seem to be the described symptoms including; redirects, Internet Explorer poping up when I access links outside firefox though my default is set to firefox, and i cannot shut down iexplorer.exe in task manager without it immediately popping back up. I also have no administrator access to my msconfig startup settings though it is the only account on this box. It simply says that Access is denied. However, I dont have anything starting up that I dont recognize.

The files seem to be appearing in my C:/windows/temp directory and when I do check that directory I have the following files inside :

hlktmp, ib6.tmp, ib7.tmp, ib8.tmp, ib9.tmp, ibA.tmp, Perflib_perfdata_384 and  Perflib_perfdata_444.

All these files seem to be in use hense not deletable. 

I have run NAV full scan and combofix with no results currently. I have tried manual removal having checked all the corresponding registry entries and they seem to all have the default values as they should including the absense of winav or printer.exe both in registry and my computer. Yes I have made sure that my system restore is Off. I've ran multiple searches for key files known to be the cause of infection but have not found them either.

I am currently running an Malwarebytes Anti-malware full scan in hopes this may at least point me in some direction but unfortunately as it is 5:17AM and i've been doing nothing but this since I got off work I will not be conscious for its log file to upload with this post. I will however post the log when I wake up unless someone might have something for me to work from before I get that chance. Once again thank you for your help. 

Replies

Kudos0

Re: Trojan.fakeAV removal issues

Hi tensiOn

Welcome to the Norton Forum

Sorry to hear you are having a problem removing this Trojan. One of the best practices when Norton tells you that it is blocking a trojan or you are having symptoms of a trojan that don't go away is to come to the Norton Forum right away. If the Norton product is current and up to date and the problem still persists, that is the time to come to this Forum. Often times and usually when you try and fix problems such as these on your own by using dangerous programs without expert advice and guidance, you often times make the problems worse. Trojans and Viruses and other malware are continuously changing and these programs to possibly work often times have to be customized to the particular Trojan and to the particular makings of the computer and to the programs running in the computer. Programs and scans created by those who know how to find problems and cures need to see the symptoms and characteristics of a trojan or rootkit when it first hits the computer without having anyone try to remove it by themselves. Once you have tried to remove something like this on your own, it often times makes it like impossible to actually remove something from a computer without making the system worse or even unusable.

Programs like Combofix are dangerous in the hands of those that don't know how to create the actual scripts that need to be created to possibly clean an infection. Without seeing certain scans from when the problem first started, there is no way of determining what was done or any new damage. Many of the programs that you may find on the net no longer are accurate and many of them aren't suffisticated enough to find the new variants of old trojans that may have the same name, but are totally different now.

It's like the current HiNI flu virus which is going around the world now. It keeps mutating and what may be one cure for one person may not be the cure for the next one. The flu may not be dangerous for everyone, but if there are underlying problems, then it can become very dangerous.

I'll leave it to others to see if they can actually help you now with this Trojan.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.19.8.65 Core Firmware 282 Chrome latest version.

This thread is closed from further comment. Please visit the forum to start a new thread.