Need Help in Removing Trojan

revolu_07 SG

Hi guys, I just downloaded AVG anti-spyware free version.

It detected the following

"Trojan.Steal" Risk = High

Located: [1340] VM_10001000

For the 1st time it was detected, I quarantined it and then I deleted it at the quarantine section.

I rebooted the comp and then did a second scan. It shows this trojan.steal again. I then quarantine it. But this time round, when I went to the AVG Quarantine section, there was no infected file at all. How come?

How do I remove it?

ndmmxiaomayi SG

Did you save a report?

Can you post the whole report here?

revolu_07 SG

AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 3:57:27 PM 3/21/2007

+ Scan result:

C:\System Volume Information\_restore{212FBE8A-C94F-446F-B2F1-6FB4BC8EBFE2}\RP182\A0181671.exe -> Downloader.Small.eig : No action taken.
C:\System Volume Information\_restore{212FBE8A-C94F-446F-B2F1-6FB4BC8EBFE2}\RP182\A0181672.exe -> Downloader.Small.eig : No action taken.
[1356] VM_10001000 -> Trojan.Steal : No action taken.

::Report end

Report as above. I have put them in quarantined. However, each time i reboot and scan, the same ting shows again..

Why is that so?

For the Trojan.Steal, it's even more strange. I scanned then quarantined. However, in the 'quarantined' section, i only saw the downloader trojan and not the 'Trojan steal' . Strange..

Need your help please. Thanks!

ndmmxiaomayi SG

Your system restore is infected, just need to clear it.

Right click My Computer and select Properties.

Select the System Restore tab.

Tick this box: Turn off System Restore on all drives. Click Apply.

When everything is being applied, untick this box. This will turn on system restore again, and will delete all previous infected system restore points.

Click OK and restart your PC.

Edit: forgotten an extra part.

Download F-Secure Blacklight

Select the Graphical user interface version. Do a scan and post the log here. Don't do anything yet.

revolu_07 SG

Well man!! Thanks a lot. I will follow what you said. But what is F-secure Blacklight?

Btw, does it mean that my system is affected already? Or just someting harmless?

ndmmxiaomayi SG

F-Secure Blacklight is to scan for rootkits. Rootkits are programs that are able to hide a lot of things. Your log show signs of some infection, so need to be sure.

revolu_07 SG

I am doing the scan now. I have already done the sys restore. Later on, should i clean or don't do anyting?

Thanks.

ndmmxiaomayi SG

Don't do anything, just exit.

Blacklight will produce a log. Just need to post that log.

revolu_07 SG

I have done the scan. It shows that nothing suspicious.

ndmmxiaomayi SG

Then should be OK.

revolu_07 SG

Grateful for your kind help. So the next time i scan with avg, shouldnt show the same thing again?

ndmmxiaomayi SG

Shouldn't be.

revolu_07 SG

Sian, just did a quick scan with AVG. It shows the 'trojan.steal' again. Dunno whether it's always shown in AVG or not.

I quarantined it. But under quarantine section, see nothing. As for the downloader trojan, i do not know whether it will reappear. Cos it only shows when i do full scan.

The system restore thing...do i need to reboot?

ndmmxiaomayi SG

Your log didn't show you quarantine. You need to click on Apply settings.

You will need to reboot after doing the system restore.

revolu_07 SG

I actually applied settings and quarantined them afterwards. I will reboot and check again.

Thanks mate.