Trojan that wont go away!

[Andl2ea]

:cry help i cant get rid of a trojan on my computer! i went to 2 free virus scanners and they both said i have infected files with a trojan that is uncleanable. i used house call and ravanti to scan. i also have nortons anti virus but that is not even picking up the virus. ravanti's log said i have 7 infected files and like 3 virus's. i dunno what to do we called windows and did everything they said and it doesnt work. i am on a network and it seems to be making my other computer slow but not this one. the other computer is also showing virus's i cannot erase. i dont really know too much about computers so im lost with this. if you could give me some insight that would be great. thanks for your time. -andrea

[MaxMercury]

Andrea,
1. What version of Windows are you using? XP?
2. Prior to discovering infection, had you installed all current Windows updates and service packs?
3. Since you have Norton AV, were you up-to-date on all anti-virus definitions prior to infection?
4. Could you please tell us -- in as much detail as possible -- what symptoms your PC displayed that led you to believe it might be infected?
5. Which Trojan is your PC infected with? (Various names have been given to them, for example JS.Scob.Trojan -- a very recent one.)
6. Where in your system did Housecall say the Trojan is located?
7. What, if any, other info did Housecall and RAV anti-virus give you about the Trojan?

The more information we have about your specific situation, the easier it'll be for one of us here to help you. :-)

P.S. Since you have Norton Anti-Virus, I suggest contacting Symantec technical support or going to their website. You could also try going to http://www.techguy.org and posting in the forums there pertaining to viruses.

Good luck!
-- Max

[Andl2ea]

i run windowsxp home edition

yes i always check for critical updates and i updated and reinstalled nortons lastnight because for some mysterious reason it got disabled, i went to nortons support and the automated help option told me registry keys were damaged and told me to reinstall it...btw they charge you to call them for assistance which i AM not paying for

symptoms were that im on a network and my other computer was running slow, we checked both computers and they both had virus's on them

trojans or virus's that rav anti virus scanner picked up were Win32/Agent.AE, Win32/Bispy, Win32/Rameh.A

Agent.AE was found in C:\Documents and Settings\Andrea\local settings\temp\polmx2.cab->polmx2.exe

Bispy was found C:\Windows\System32\biQ.exe-PWS

Rameh.A was found in C:\windows\system32\Qu3st4u.dll

housecall told me it was uncleanable and rav anti didnt clean any of them. housecall only picked up 5 infected files, rav anti picked up 7 and adaware 6.0 picked up 12 infected files with i quartined this morning.........i ran rav anti again and these 3 still popped up. :(

[MaxMercury]

Andrea,
Did you disable "system restore" before running your anti-virus programs? If not, the problem could be that your AV programs are detecting the Trojans within your restore points. But XP is designed to not allow you to remove restore points, so the AV programs can't clean your system.

Disclaimer: Before you try the following, note that I'm simply a computer geek with a lot of experience and some professional training. If you don't feel comfortable trying the following, please don't and pursue advice elsewhere.

OK, if you feel comfortable with it, you can try the following:
1. Disable system restore. If you don't know how to do this, you can read about it here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam

2. Re-boot your PC.

3. Re-enable system restore.

Then run a full scan of your system with any anti-virus programs you trust to see if the problems have been removed.

Good luck!
-- Max

[Andl2ea]

:-( well i been talkn to a couple of other people and they told me to disable system restore also. it wasnt on when i posted. but i did turn it back on and reboot and all that good stuff. even scanned pc, same problems. i disabled it again. but same stuff, also i used another virus scanner called Panda active scanner and it didnt catch ANY of the virus's i told you about that rav anti virus catches. it catches only one and that one was downloader.gk. its funny how all these different scanners can come up with different things. i dont know whats really on my computer and whats not? my boyfriend seemed to fix his virus, his virus said it was icool or something. so its just this computer im having problems with right at the moment. :(

[TheMattrix]

Did you try AVG (http://free.grisoft.com/freeweb.php/doc/2/) Anti-Virus? That's my favorite (and it's free).

If you can narrow the virus down to a specific file that you just can't delete, try MoveOnBoot (http://www.softwarepatch.com/software/moveonboot.html). It'll delete the file right when Windows boots, before it loads any programs.

[Andl2ea]

:-D hi thanks for having me download avg it got rid of one of my trojans which was bispy. i used rav anti virus scanner again right after and it still picked up Agent.AE and Rameh.A. but at least i got rid of one. i disabled nortons so i could run AVG. it says the email scanner is still on the nortons. will that conflict with AVG? also any ideas on the other trojans rav anti virus is picking up? thanks for all your help! -andrea

[Andl2ea]

:wig im tryn to figure out how to go about looking for the files, i downloaded the boot thing you told me about but, im kind of worried about deleting stuff like that, especially when i dont know what im doing. i posted the files that the rameh.a virus was in and the agent.ae. can you tell me how i look for those files?

[Andl2ea]

ok i found the Qu3st4u.dll for you file but not the biQ.exe-PWS file. now what exactly do i do when i download movetoboot? it gives me the option to modify or repair stuff or uninstall the movetoboot.

[TheMattrix]

Um, I think after you install MoveOnBoot, it'll add a shell extension to explorer, so you can right click on the file, and select "Delete On Boot" or something similar on the menu.

[Andl2ea]

:thumbsup im glad to say i was working with another forum and was able to get rid of all my virus's! thanks so much for your time! -andrea :-D

[TheMattrix]

Excellent :-D
Glad we could help!