[ Home | FAQ-Related Q&As | General Q&As | Answered Questions ]

Search the Q&A Archives

I have a trojan horse virus and cannot get anyone to tell me...

<< Back to: VIRUS-L/comp.virus Frequently Asked Questions (FAQ) v2.00

Answer by e.patterson
Submitted on 4/6/2004
Rating:	Rate this answer:
you should not need to reformat.firstly you should download avg'sfree antivirus.its at grisoft. next if you have windows m.e it is quite easy to get rid of the trojan horses.run avg and it will heal ALMOST all the files.you will then be left with a file of the trojan (or several files depending on which it is) in your restore file.make a note of the numbers that avg comes up with these will be cpy files.then you will need to unhide all hidden files. this will result in showing your restore file DO NOT DELETE THIS FILE... next right click my computer.then right click properties.click the performance tab.at the bottom of that page click the file system tab.on the next page click troubleshooting.then on the final page find the disable restore file and check the box and click apply.you will then need to restart your computer.it might start in safe mode but usually M.E starts straight up.before looking for the files by hand open my computer then open c drive and right click on the restore file you will be presented with a chance to scan again with avg do this and you will probably find the trojan has automatically been deleted of not you will have to search for the files by hand and delete them. this sounds like a a lot of work but it only takes about 5 mins from start to finish once you have avg installed.i get trojans as reguler as clockwork and find this is as easy a way as any to get rid of them again.for other malware i suggest "spybot search and destroy 1.2" this gets rid of spyware and also CWShredder for any other annoying little problems.all three can safely be run side by side and all are free for home users.hope this helps some of you at least.

Answer by ksdust
Submitted on 5/3/2004
Rating:	Rate this answer:
after avg has cleaned the trojan you have to disable system restore to get everything out. then when it's okay you can enable system restore again. e pattrson posted this on April 6-- you should not need to reformat.firstly you should download avg'sfree antivirus.its at grisoft. next if you have windows m.e it is quite easy to get rid of the trojan horses.run avg and it will heal ALMOST all the files.you will then be left with a file of the trojan (or several files depending on which it is) in your restore file.make a note of the numbers that avg comes up with these will be cpy files.then you will need to unhide all hidden files. this will result in showing your restore file DO NOT DELETE THIS FILE... next right click my computer.then right click properties.click the performance tab.at the bottom of that page click the file system tab.on the next page click troubleshooting.then on the final page find the disable restore file and check the box and click apply.you will then need to restart your computer.it might start in safe mode but usually M.E starts straight up.before looking for the files by hand open my computer then open c drive and right click on the restore file you will be presented with a chance to scan again with avg do this and you will probably find the trojan has automatically been deleted of not you will have to search for the files by hand and delete them. this sounds like a a lot of work but it only takes about 5 mins from start to finish once you have avg installed.i get trojans as reguler as clockwork and find this is as easy a way as any to get rid of them again.for other malware i suggest "spybot search and destroy 1.2" this gets rid of spyware and also CWShredder for any other annoying little problems.all three can safely be run side by side and all are free for home users.hope this helps some of you at least.

Answer by Jcldwl
Submitted on 5/11/2004
Rating:	Rate this answer:
I have gotten several Trojan Horse viruses and my wife just had one on her computer today. We both run XP I have home she has Pro. She has the Downloader.Q.down.C and I am currently trying turning off the system restore/restarting in safemode/and rerunning AVG to clean the virus out. I will let you know if it works. My AVG caught the PSW.briss.D and PSW.briss.E trojans a couple of days ago and I was not even aware of it but checked my test results after my wife's trojan showed up. I have done three scans since and they are not showing up so I assume they are gone. On April 29th I was infected with the Revop.C and PSW.briss.A and also had a warning of a possible infected start page. Of course my start page had been changed to something I had no idea what it was and a search bar had been installed on my computer that appeared above my task bar at the bottom of the screen. I spent my entire morining cleaning up. It took a total of three scans with AVG to finally get rid of all the infected files. OR at least I think they are all gone. Unless they have the ability to hide and rear their ugly faces another time. Who knows?

Answer by jcldwl
Submitted on 5/11/2004
Rating:	Rate this answer:
OK, I appear to have rid myself of these trojan horses by following the suggested restore off scan restore on. this is in windows XP Home or Pro. Turn off system restore/restart computer/go to housecall.trendmicro.com and use the free virus scan option. It will download latest definitions to your computer and then scan. after scan turn system restore back on. I then scanned again after that. If it still finds trojan horses then after you turn off system restore, reboot into safe mode to do your scan then after scanning reboot into normal mode and turn your system restore back on. That is how I cleared up my wife's computer. To turn off system restore right click on my computer/left click properties/left click on system restore tab/and put a check mark in the turn off system restore box/then click apply. To turn it back on simply remove that check mark and click apply. To get into safe mode if needed while computer is restarting continuosly tap f8(no need to pound on it just a steady contiunous tap) a black screen with a white lettered menu will come up asking you how you would like to start up your computer. choose "SAFE MODE" and hit enter. Hope this helps.

Answer by phyl
Submitted on 6/5/2004
Rating:	Rate this answer:
All Trojan horses are hidden files, in order to get at them you will need to go to the Files Option (click the View tab)at Control Panel and uncheck both the Hide file extension for known file types & Hide protected operating system files (Recommended)-boxes, then OK yourself out. Then you will need to restart your computer and go into SafeMode by HOLDING the F8 key DOWN -(at bootup - after the first screen info - be quick!) and choose SafeMode. [You have to use your keyboard when you're in SafeMode - the keys to use are Ctrl/Alt/Delete (to exit the Help and Support screen) - Tab/Arrow keys/ Pageup/Pagedown/ the Window key(between Ctrl & Alt) & Enter] So, from the DeskTop screen press the Window key to get Start/ arrow up to Search/ arrow right to For Files or Folders and type up the NAME OF THE FILE & EXT (not for example horse.winshow.V) but the actual name of the file, which would have shown up on your anti-virus software. To delete this file from here just press Page Up to highlight the file and then delete. To get out of Search -Alt F/ arrow down to Close and press Enter. Press the Window key to shutdown and restart your computer. It will be safe to empty your Recycle Bin in the Normal mode where you can use your mouse. I have had 4 trojan horses on my C drive and kinda figured out the above method a week ago. After unchecking the hidden files boxes I deleted the Temp file (as these keep putting the same files back into your system) from the _Restore folder , then went to SafeMode to delete what virus files that were still there. My computer is now absolutely FREE of these pests! hope this helps...Phyl ps. I also have AVG 6.0 (the free one) & also the Ad-aware 6 and I use them every day as my kids love to play games from the Internet.

Answer by Davo
Submitted on 8/16/2004
Rating: Not yet rated	Rate this answer:
I also have Downloader.Apropo.d...cleaned it out with the AVG6.0 and disabled the System Restore as above. Everything looked nice...until the programmes which create these files recreated it. This trojan is like herpes...you only "see" the result when it tries to breed..the actual bug is hidden deeper...there are several processes going on...thats how i believe it is working...but i am not good enough to dig it out...despite about 15 hours so far...i have read of people managing to get rid of it...i think if i had gone into safe mode and restored at a date prior to infection, that would have worked...as it is now I have deleted all those early restore points with the attempt to clean up as described by e.patterson, so now i have to find those progs...i think they are in the system root files...of course the thing is not doing much harm as far as i can tell..AVG has got it spotted and denies it access...but it is annoying and destabilises my system...

Answer by Angelita
Submitted on 9/3/2004
Rating: Not yet rated	Rate this answer:
Hi there. I am having some issues with viruses as well. AVG has cleared out all of my infected files with the exception of two of them which are embedded. I can't do a system restore anymore because like an idiot, I turned it off and now have no good date to go back to. I've tried multiple programs that can't get rid of them. I've heard the only way to do it is re-format or take it in, and I'm not going to take it in. So, I will probably re-format. The virus won't let me get on the computer anymore, so unless there is a program that will get rid of embedded Trojan Horse Bispy.B and whatever other one I have, then I'll have to download it onto a disk and transfer it to my comp. :P

Answer by Angelita
Submitted on 9/3/2004
Rating: Not yet rated	Rate this answer:
Hi there. I am having some issues with viruses as well. AVG has cleared out all of my infected files with the exception of two of them which are embedded. I can't do a system restore anymore because like an idiot, I turned it off and now have no good date to go back to. I've tried multiple programs that can't get rid of them. I've heard the only way to do it is re-format or take it in, and I'm not going to take it in. So, I will probably re-format. The virus won't let me get on the computer anymore, so unless there is a program that will get rid of embedded Trojan Horse Bispy.B and whatever other one I have, then I'll have to download it onto a disk and transfer it to my comp. :P

Answer by Bri
Submitted on 9/17/2004
Rating: Not yet rated	Rate this answer:
PLEASE HELP! I've read all these articles, and I've tried them with no luck. I have the Trojan Horse PWS virus on my Windows XP, and I cannot remove it. My avg 7.0 detects it, but it does not heal it. My A2 free version did detect it, but now it is not acknowledging it. I've also tried to search for the file, to delete it, but it says that it cannot find the file. I've tried unhiding my files, and I've deactivated my System Restore, nothing seems to work. I'm searching for the file name: bi.dll, and prelnsBl.exe, with key words Trojan horse, and PSW Bispy, is this correct?? Can somebody please help me!! I've been trying to fix this now for the past 6 hours straight...with no results :(

Answer by szah
Submitted on 10/12/2004
Rating: Not yet rated	Rate this answer:
I got this information from www.windowsecurity.com/trojanscan/faq.asp "C:/system volume information is a special, protected system folder. Nothing, including anti-virus programs, can modify it. All you have to do to get rid of this Trojan (which is not active by the way, but will be if you'll use the restore function of Windows) is to disable the restore Windows feature. On Windows XP you can do this by right clicking on the "My Computer" icon then choose Properties, System Restore and check the box: "Turn off System Restore on all drives", hit apply, and restart the system. Your System Volume Information Folder should now be gone and the Trojan with it." I hope it will help.

Answer by Elaine
Submitted on 10/28/2004
Rating: Not yet rated	Rate this answer:
I also have a virus and it is Called Trojan Horse. It makes web pages pop up even when all of mine are closed and it also gives me pop-ups. I am practically computer-illiterate and had a virus on my windows XP before. it was called spybot and it messed up my computer. Now, when it freezes, the button you push to turn on and off your computer doesn'twork. you have to flip the power strip off and back on. I found it yesterday and tried to do print screen to save&print out the things said on my screen, but my computer would not let me. Norton Antivirus also said a few more times that I had it, so i have it in multiple files and all of the files it said that access was denied except on one. I you have any more advice, please tell. Thanks, -e