Keep Getting a Trojan Horse/Worm and I don't know how to get rid of it

[weristich]

Hi,

I have been using this computer for three years now.  It is like my baby.  All three years I have been using avast and there has only once been a problem.  A couple of weeks ago, I have a problem with this one malware, which I finally managed to get removed.  Then about a week ago, I got Win32:Small-iky.  Finally got rid of that.  Now, whenever I start firefox, a pop up for a site comes up using Internet Explorer.  A few minutes later it says that Avast has detected a worm or trojan horse, I can't remember which.  Next time it comes up, I will write it down.  Can someone please help me get rid of it.

[Lisandro]

I suggest the general cleaning procedure for virus that come and go...

1. Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it's not available in Windows 2k. After boot you can enable System Restore again after step 3.

2. Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.

3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

4. It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.

5. If you still detecting any strange behavior or even you're sure you're not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG or Panda.

6. Also, if you still detecting strange behaviors or you want to be sure you're clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

7. After you're clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

8. Finally, when you're clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.

[weristich]

The thing it is detecting is called Win-32:SecBarB

[Spiritsongs]

   Hi Weristich :

     A "Worm" or a "Trojan Horse" is NOT a "virus"; those are best dealt with by
     using an antiSPYWARE/antiTROJAN program, such as the FREE version of
     "SUPERAntiSpyware" from www.superantispyware.com .
     For the 2nd time " Other than Avast, WHAT other security program(s) do
     you have on your computer ? What is the Name of your Operating
     System ?
     By the Way : cleaning your "Temporary Files" is best done by using the
     FREE "ATF Cleaner", developed by antiSPYWARE Expert "Atribune", and
     available at his website at www.atribune.org/content/view/19/2/  .

[weristich]

Hi,

I have Avast, Sypbot Search and Destroy, and Ad-Aware.  My computer is running Windows XP and I already use ATF Cleaner to clean up the temporary files.  By the way, it was a virus earlier this week, it has changed to this Win32 thing.

[oldman]

Your tow scanners are rather light wieght. Use SAS as suggested by Spiritsongs.

Make sure to update it first.

Physically disconect from the internet
Pause avast standard shield

Under Configuration and Preferences, click the Preferences button.
Then click the Scanning Control tab.



Under Scanner Options make sure the following are checked
- CHECK ALL BOXES




Return to the main page by clicking close on that screen. On the main screen, under Scan for Harmful Software click Scan your computer. On the left check C:\Fixed Drive.(and other fixed drives)
Under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan.

When the scan is done, quarentine everything found . Reboot if asked. You can post the log in your next reply if you wish.

[DavidR]

As far as anti-spyware goes spybot S&D and adaware are lightweight (IMHO) when compared to the applications listed at item 4 of Tech's post and also suggested by Spirtisongs and oldman. I would suggest you download, install update and run (preferably from safe more) SuperAntiSpyware.

[weristich]

Okay, I will do as you three suggested.  Since it's during finals, I will post back if I am still having issues when I get around to doing these things.  Thanks for your help.

[DavidR]

No problem, welcome to the forums.

[Lisandro]

I have Avast, Sypbot Search and Destroy, and Ad-Aware.

I gave up on Ad-aware. Services running in background for nothing, bad uninstallation process and worst: never detects anything... just cookies... too weak imho.