Help! There's a trojan in my PC

Viruses and worms
1

I don’t know what I’m supposed to do I just scanned my PC with AVAST home edition (boot scan) and I found out there was a trojan there which I moved to chest. I’m using Windows XP and the trojan thing disables my task manager and makes a default home page that I can’t change. I used a software that can solve both problems but after a few seconds the task manager and default home page become disabled again. What’s more I can’t see the “Run” command on my start menu anymore. When I look at the processes running I see two “Isass.exe” processes running… I seriously have no idea about what I can do to get rid of the horrible thing. Please I need your help on what I should do next…urgent! Thanks and God bless. - Nimmy

2

Welcome to the forum Nimmy.

Can you tell us the name of the trojan, the file name and location.

Lsass.exe is a Windows file that should be in c:\windows\system32. Please search your computer to see if there are any instances in other locations.

isass.exe, on the other hand, is malware. Please make sure which you have (maybe both?).

3

:slight_smile: Hi Sister In The Lord :

 You have what is usually called a "Hijacker" and it would be best if you had the help of an
  experienced, trained, volunteer Malware Expert, who are usually found on antiSPYWARE
  Support Forums, such as the Ad-Aware oriented one at www.landzdown.com . Such Experts
 want to see a "log" from the "HijackThis" program, therefore, I recommend you download HijackThis© from:  www.thespykiller.co.uk/files/HJTsetup.exe .

At the download prompt, choose “Save”.
Navigate to the saved file and double-click the installer, HJTsetup.exe.
HijackThis will be installed on your computer at C:\Program Files\HijackThis, making an entry in the start menu and also providing a desktop shortcut.
When the installation is complete, exit HijackThis.

Info on HOW to post a HijackThis log is at :
www.bleepingcomputer.com/tutorials/tutorial94.html ;
of course, skip “Steps 1 - 3” .

4

Things are slow again for you , Spiritsongs?

5

Thanks for the help. Actually my brother took control of the situation (he’s much better at computers than I am-esp virus and such). The trojan name was win32: trojan-gen and it it infected the restore file and some of my web files. I couldn’t even restore my system cos all restore points had been deleted! Thank God my brother was able to figure a way out, took him all of yesterday to do that. He said the trojan file was called lsass.exe and it had infected my Shell file…However, I still have problems with creating new folders on my system. I don’t know what I should do next. Where can I get Avast anti-spyware? I think that would help. I haven’t tried intalling the HijackThis program yet, I think I want to try Avast anti-spyware first. Thanks for your help once again. God bless!

6

What problem(s) do you have? Are you unable to make a folder at all or something else? Can you save other files - say a new text file - or is this a problem too?

Avast! is an antivirus product that can handle some spyware. There’s is no avast! antispyware but AVG Antispyware compliments avast! well. You can get a free version here

http://free.grisoft.com/doc/20/lng/us/tpl/v5

Try that first and then we can look at a hijackthis log if the problems persist (make sure you don’t “fix” anything with hijackthis - just post a log if wish).