I really need some help....

Viruses and worms
1

Well, where to begin, lets start with that i have Avast 4.6 home edition and its fullly updated, actually, better to list all of my virus/spyware stuff first:

Avast 4.6
Spybot search & destroy
Miscrosoft Spyware Scanner
AVG
Ad-ware SE

Now, I have been plauged fir the last 4 days with some spyware, little did i know that was only the small picture. Lately my comp has been acting up and downloading slowly (im on my notebook right now). I have Free Zonealarm firewall installed on my computer, and its been on for the past month, the settings for the firewall are high. Now, yesterday i was doing a spyware scan with Microsoft’s scanner because of the spyware that was annoying me from the past few days, it finished, found 129 things, which came as a surprize because that previous monday i had nothing on my comp, anyway i deleted everything and did anoter scan, once again it found some stuff, 37 this time,i deleted them, and scanned again. This time it found only 3 things, i deleted em scanned again but the 3 things i had deleted were still there. So i said tomyself, now this is damn strange… I loaded up avast, scanned, and nothing came up, used avg, it found a trojan, i deleted it off. I ran avast again, still nothing. So, i decided to let it slip and went about running my online game server. Now, about 3 or 4 hours later, the on access scanner reported about 3 trojan viruses. When i tried to delete them it said it oculdnt and i schedualed a boot time scan. So, when i went to bed that night i restarted my computer and let the boot time scan run. Got up in the morning and logged in… first thing that happened was that the on access scanned spammed me with about 8 trojan visrus warnings. When i tried to delete the first one, my computer restarted itself. Now im geting mad, I have never bended over backwards to a virus, and i srue aint gona start, so i disconnect from the internet, and scan scan scan, delete delete delete anything that i found… well, its been 2 days now, and i still can get this thing called Zolob off of my comp. Avast donest ever read the infected file (i found this file with Microsoft’s scanner, it registered a bad registry key that after 5 deletions was still present, so i went and checked it out, copied the file path down, J:\WINDOWS\System32\drfgsrv.exe) as a virus when i scan it. Miscrosofts scanner called it a trojan downloader. Despite everything i have tried it wont be deleted, and i dont want to reformat my hard drive either, so can anyone help me?

i just did an online scan of that file using Kaspersky and heres the virus name:

Trojan-Downloader.Win32.Zlob.hw

2

Hi GeoWil

Having avast and AVG installed at the same time can cause problems. You should decide on one and uninstall the other.

And, rather than deleting things just put them in quarantine for now if the scanner gives you that option.

Can you let us know what operating system you have, and also post the names and full paths of the 3 remaining trojans?

Edit:

Is Trojan-Downloader.Win32.Zlob.hw the only thing left now? Same path as before?

3

i have windows XP SP2, and yes, as far as i know its the only thing left, full path is:
J:/WINDOWS/System32/drfgsrv.exe (same path a before). I dowloaded kaspersky’s virus scanner and an scanning my sys32 folder right now, see if anything else can be found besides that.

Well, Kaspersky cant delete it, so im going to try a boot scan with it.

Also, wheni try to put it into qarantine it saus access denied or insufficiant rights (this account i am on is set to system admin).

i dont know if its relevant or not, but right before this all started, something calledSpyFalcon was installed on my computer from god knows where, i was looking around my gaming servers site and this message said now downloading and installing SpyFalcon…

4

:slight_smile: Hi GeoWil :

 To "complement" your antivirus ( hope you have removed
 one by now ) & your antispyware programs ( though I do
 not like the Microsoft antispyware because they are "beta")
 it would be a good idea to have a program that
"specializes" in detecting & removing trojans, worms,
 generic dialers, such as "Ewido" available from 
 www.ewido.net/en . There is a "tutorial" at :
 www.greyknight17.com/spy/Tutorials/ewidoQuickGuide.pdf
 SpyFalcon is a serious spyware; you may have more. 
 Therefore, since you have Ad-Aware, I recommend you seek
 assistance from the Experts on the forums at :
 www.landzdown.com . They will get your machine completely
 clean .
5

ewido did not find anything in that file. though it did find some stuff in my registry. im going to run a full scan with it and see if it catches anything.

omfg… 200 infections and counting, man, i got a !@%#in’ infestation here LOL :-X

6

GeoWil

There are several links to SpyFalcon (aka SpyAxe and SpySheriff) removal tools in the following thread

http://forum.avast.com/index.php?topic=19483.0

See if these help.

7

well, i managed to get most of the stuff off, but i did find another trojan downloader, and the ppl at landzdown have me using hijack this. i had about 254 infections deteced by that malware scanner and i deleted those, then kaspersky found the second trojan downloader, which i got deleted. still, im running more scans before i reconet the comp to the internet, lol better safe then sorry i always say

8

The one thing I don’t see on the list of security programs in your first post is a firewall, which is an essential part of your system security ?
if your using the XP firewall it doesn’t provide outbound protection, so there is nothing stopping any malware on your system connecting to the internet and downloading more of the same, hence the name trojan.downloader.