How do I get rid of Win32/darksma.x trojan/downloader?

Answer 1

WOW, I got tired from reading the answer from why not. Need to give him a new nickname of "Talks alot and full of hot air" His way is too long and will take up alot of your time and will not work. Why do all that when you can use one program to do it all. He says try this and see what happens. What?? wow. I garanDAMNtee my answers and will even help you personally if need be. Your problem will not be a problem at all.
Here's what you need to do.
1st, don't waste your time with AVG, spybot, ad aware, CA, spyhunter, superantispyware, avast, panda, kaspersky, windows defender or anything of the sort. Stay away from anything that is FREE when it comes to spyware and antivirus. There is a reason why they free. They are NOT good.
2nd, You need some of the best software out there. Norton Systemworks is very good. That's the only good software from Norton. I wouldn't recommend Norton Internet security, its not that great. Now the best software you should get is Spysweeper with Anti-virus, this software is too good and gets better everyday. This is elite software. It blocks over 174,500 threats. No other software can compete with that or come close for that matter. It catches everything. I've used them all and it is 2nd to none.
3rd, after you install and update the software, since its in your system you will have to turn off system restore and then go into safe mode and run the scan and eliminate the virus. then after removal, reboot and turn system restore back on.
4th, (Optional) I recommend a Firewall from Zone Alarm, their free version is so good. Or you can buy their Pro version, but the free version will do more than the job.
5th, any probs during or after you do all this, send me an e-mail.

Answer 2

If you have antivirus software in you pc, run the scanner. If you don't then here is a free antivirus program from AOL, Active Virus Shield, powered by Kaspersky of Russia. Rated # 1 in the world for virus detection. AOL, will only ask you for your email so they can send you a free key good for one year. After one year you need to request a new key. You will get auto updates every hour on the hour, plus excellent real time scanner in the background.

http://www.activevirusshield.com/antivirus/freeav/index.adp

If you already have antivirus and it failed to find the virus, then you can run "online scanner", from the servers of Kaspersky of Russia.

There will be no conflict with the antivirus you already have.

http://www.kaspersky.com/virusscanner

Reboot after the scanner find the virus and kills.

Minddoctor, France

Answer 3

Get SpyBot Search & Destroy to safely remove spyware. Best of all, it’s free. After installing it, immunize the computer against over 18,000 known pieces of spyware. Then run a full bot check and remove everything it finds using the Fix Selected Problems tab. Keep it updated and run it weekly to keep your computer free of this stuff. Then get Ad-Aware also from download.com and run it the first time doing a Full System Scan. Thereafter, run a Smart Scan daily.
http://www.download.com/

Keep them both updated and use them.

Answer 4

have put in and run undercover agent ware well-being practitioner, it exhibits this trojan then says it has bumped off it, then i restart my laptop, do yet another test and the trojan is back - the trojan is in device fix. turn off device fix, boot in risk-free mode, run undercover agent ware well-being practitioner, re boot, if sparkling activate device fix. while sparkling flow to domicile windows replace you should be on SP2 or SP3 with the help of now.

Answer 5

most virus are spread through IE. IE is not a safe browser. you should use a more secure browser to protect your PC from virus.

i recommand you to use firefox with Google toolbar. firefox can block any any popup and disable any virus and adware, spyware on webpage, so, firefox is much safer than IE browser. as you know, most of virus spread throught internet and webpage.

besides, firefox is much smaller than IE, so it run faster than IE.

download firefox for free, Just have a try:

http://www.toolforyou.net/firefox/

Good Luck !!!

Answer 6

First, you will need to get some software programs to help you. The following programs are what I use personally. Not only do I trust them, but they are also free for personal use. The companies that provide the free software, also provide software that they sell for use in a commercial environment. Usually, the free versions are just as good but simply don't have as many of the extra features which make the commercial versions even more attractive to use.

Anti-Spyware Software

• CWShredder - You can find it at [www.trendmicro.com]
• Lavasoft's Ad-Aware - You can find it at [www.lavasoftusa.com]
• Spybot S&D - You can find it at [www.spybot.info]

• AVG AntiSpyware - You can find it at [free.grisoft.com] / [www.ewido.net]
Anti-Virus Software


First you will want to download each of the above programs and then install them. After you install them, you MUST update them so you will have the latest protection. There is one small exception: CWShredder is a stand-alone program that doesn't need to be installed, but you do need to have it check for an update to ensure that you have the latest version. If you don't update these programs and you are infected with the latest parasites, you will not be able to effectively detect and clean them from your computer, so remember to update, update, update.

Since spyware is a bigger problem today than viruses, and spyware is typically harder to find and get rid of, I suggest to start looking for spyware first. I also use the different AS software packages in a specific order so that I go after the tougher problems first and the easiest ones last. What follows is fairly lengthy, but it will take care of just about anything.

1) Turn off System Restore

• WinXP has a cool feature called System Restore. It is used to restore your computer to an earlier configuration in case of a problem. The only problem is that it wasn't made with parasites in mind, and often it can't tell the difference between an infected file and a good file, so it might automatically restore an infected file also if it had been in a protected area, effectively re-infecting your computer. Because of this, it is recommended to turn off System Restore before you test, and when you're done, turn it back on so you are still protected from standard computer problems.


Click Start.
Right-click the My Computer icon, and then click Properties.
Click the System Restore tab.
Check "Turn off System Restore" or "Turn off System Restore on all drives."
Click Apply.
When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
Click OK.

2) Carefully Look at Windows Add/Remove programs for suspicious programs

• Many of the spyware threats actually install into your system like a program. Many appear to be utilities that you may think are helpful but in reality aren't. Look for add-an toolbars, while toolbars like those provided by Google, MSN, Yahoo and other are great utils, there are many more that aren't and if in doubt check it out to see if ones you have are parasitic. Another common exploit are the Search helpers, WinTools, Gator products, IE Helper, Comet Cursor and many others just to name a very few. Peer-to-Peer (P2P) programs are another common source for these and even the ones that doen't come with spyware themselves are a security risk that may lead to your system being infected or to spread infections like these. Remove all suspicious programs, if you are wrong, you may always re-install them later.

3) Run Disk Clean-Up

• This actually comes with Windows and has been installed by default since Windows 98. You can find it by clicking the Start Button and then going to Programs / Accessories / System Tools / Disk Clean-up. I recommend selecting all of its options except the ones for Office Setup Files and Compress Old Files if you have them. While you may select those if you wish, they aren't as important. This will clean up all of the temporary files so your testing will go faster, and may also delete any spyware that may hiding there if the spyware isn't already running. To clear systems that have System Restore you will need to select the second tab and click the button for clearing this.

4) Empty your Internet Explorer cache

• Open Internet Explorer and go to Tools..Internet Options… and under the General tab, in the Browsing History section, click Delete… and then select Temporary Internet Files. This probably won’t eliminate any viruses but will make the scanning go faster.

5) Run CWShredder

• This is made for detecting and cleaning of the infamous CoolWebSearch exploits. Currently there are about 40 types of these, each with up to 4 variants and growing. These are some of the toughest ones to get rid of.

6) Run Ad-Aware next

• This handles the next toughest types the best. When it finally presents you with the list of parasites it has found, put a check mark in the box next to the ones you want to get rid of, I suggest checking them all. If you want to select all, just right-click your mouse on the boxes to get the options menu, and left-click on Select All. If it says it can't get rid of a problem right now, it will ask if you want to run it again after you restart your computer, answer yes and restart your computer so it may test again.

7) Run Spybot next

• When you run it, it will automatically select all the spyware that it finds, if there is something you don't want to get rid of for some reason, deselect it and then let Spybot fix all of the rest of the problems that it finds. This program also will ask to restart your computer so it can test again if it has problems removing something, so let it.

If you had Windows 2000 or Windows XP ( not the 64bit version ) you also have this option...


8) Now Run The AVG Program

• Run the “Complete system scan” option. AVG will scan all of the files when you scan your computer; it will likely take . a long time to complete.

• If you found any parasites, you need to restart your computer so you can test everything again. There are times that after cleaning certain parasites you will need to test again because something may have been hidden earlier by the infection. So repeat this process of testing and restarting until you find no more parasites.

• Run the scans again in Safe Mode. This will keep many of the parasites from loading and being able to hide from your protection software. To access Safe Mode on most versions of Windows, start tapping the [F8] key after you first start or restart your system, start tapping it before you ever see a Windows Splash Screen and continue until you get the Menu where you may select it from the list. On WinNT, this is called VGA mode and on Win2k you actually start tapping just after the first splash screen shows. For Detailed instructions see Restarting Your Computer in Safe Mode

These procedures should have cleaned most cases of infection that you will find. Yes I said MOST because there are some infections that are very hard to detect and remove. Generally, if you have one of these, you will need the assistance of an expert to help you get rid of it.

When you believe you are finished, remember to turn System Restore back on if you had turned it off.

I recommend testing for parasites as often as you can, probably at least once a month if not more. The sooner you catch them, the less damage they can do to your computer, and the less chance of a hacker finding your sensitive information such as checking account info, passwords, etc.


9) Reboot your computer normally.
• If you're still having problems, continue with the following:

10) Go to
http://www.spywareinfo.com/~merijn/progr...
• and download HiJackThis. Run the program, which will create a log file. Go to

http://forums.spywareinfo.com/

• and post your HiJackThis log. You will get an extremely rapid, very precise answer as to whether or not you still have any infections and, if so, exactly what to do.

11) After everything is all cleaned up
• I recommend installing

SpywareTerminator (free):

http://www.spywareterminator.com/
Good luck!

Answer 7

Follow these steps and it will remove almost all viruses and malware/spyware from your computer. It will also make your computer run faster.All are free to download from file hippo.com and download.com
.
•I know this procedure looks long, but much of this is explanatory text to help less experienced people.
•Please do not cheat by skipping any steps. You are only hurting yourself if you do. And you will waste more time. The goal is to get your PC fixed. Completing the steps in this generic guide may or may not resolve all of your malware problems, but in all cases it gets your PC into a known state to help make it easier for me to fix your problems. After completing all steps, if you still need help, please send a new question. You may have a problem trying to run steps in safe mode on user accounts that have limited priviledges. This will only be on Windows 2K, XP, & 2003 systems. Limited user accounts will not show when you boot into safe mode. You have two options, run the steps in normal boot mode which may not work to remove malware, or you can temporarily change the user account to an admin account and then complete the steps.
•0: Preliminary House Cleaning & Setup

Unistall Malware thru your computers Add?Remove program.
You MUST be sure that MSconfig is not being used to control Startups. Note: That some Window's OSs (like Win 2K) do not have MSconfig!
•MSConfig Startup Mode
Please go to Start > Run > type msconfig and click OK!
Select the General tab and select Normal Startup.
Thenclick Apply and OK and reboot PC before continuing.
Remain in this Normal Startup mode while your PC is being cleaned of malware.
1: Secondary House Cleaning

This second step of house cleaning may save a load of time later .
•Empty any quarantine folders for antivirus and antispyware applications. Make sure you do this. Logs could be huge otherwise. If you are a Symantec/Norton user make sure you empty their Norton Nprotect folder guarding the Recycle Bin. Empty your Recycle Bin
•Download and install CCCleaner
•MAKE SURE you download and avoid getting the Yahoo Toolbar version. I do not want you to install any unnecessary baggage.
•Also it is recommeded to login to all other User Accounts on the PC including the Administrator account which will only show when you boot in safe mode. Run CCleaner on each account. This can greatly reduce scan time and log sizes from the later scanning you will do below.
2: Enable viewing of hidden files, system files and file extensions

Some programs hide themselves by making their files invisible in normal Windows settings. Not doing this would allow file extensions commonly used by trojans and spyware to be hidden, for example a file ending in .exe or dll making manually finding it, if needed, difficult to impossible.


3: Do not use Multiple Antivirus Applications or Software Firewalls
•Antivirus: If you have multiple antivirus applications installed on your PC, please choose the one you prefer and uninstall all others. Do this now before continuing because you will only be asked to do it later if not done now. This does not mean online scanners. It is only referring to full antivirus applications like McAfee, Symantec, AVG, Avast, AntiVir, Kaspersky, etc.
•Firewall: Only use one software firewall. Running multiple software firewalls is unnecessary and using more than one software firewall on the same connection could cause issues with connectivity to the Internet or other unexpected behavior including excessive use of system resources which will slow down overall PC performance.
4: Downloading Tools

Download the following tools and save in your favorite download folder or create one, for example C:\Spyware Tools or C:\Downloads. ( It is not a good idea to download them to any folder within C:\Documents and Settings.) And then install, update, and configure as indicated below. Do not run the scans until later when indicated. Also DO NOT confuse the word download with the actual installation of the program. You should install all programs to their recommended (by the install program). default installation folders. First you download the files and then you install (if the program requires installation) the program. It is also a bad idea to download and save anything you need into any kind of Temp folder. Malware hides in Temp folders and standard cleaning practices will delete everything from Temp folders.

Download GetRunKey.Zip and ShowNew.Zip from the below links and extract all files from both ZIP files into a folder of their own. You can extract both ZIP files into the same folder. Like C:\MGTools While these tools will run from your Desktop, i strongly recommend that you DO NOT extract them to your Desktop. Please install them where recommended. Do not run the scans yet!!!


SpyBot - Search & Destroy
•PLEASE leave all settings at default!!!! Install, do the search for updates now and get any updates, then fix the below problem with Spybot default products. If you get an error message about "bad checksum" when trying to update, just choose a different server location. Also look for the Immunize feature in Spybot and use it. Do not use the Teatimer function. It can be a resource hog and also makes removal of certain problems more difficult. Make sure you leave the SDhelper ( IE bad download blocker) checked to install (this is the default).
•Fixing SpyBot's Ignore Products Bug: Please run SpyBot and get into the Advanced mode by selecting Mode and then Advanced mode. Then select Settings and the in the left column select Ignore Products. In the right window pane make sure the All products tab is selected. Then in that window, right click your mouse and choose "Deselect all". Now exit Spybot. We will run a scan later.
Now if running Windows XP, 2K or NT do the below. If you have Windows 95, 98, or ME skip to Downloads for Older Windows OS below. CounterSpy and AVG Antispyware will no longer run on the older Windows's OS.

CounterSpy

•If you had previously used a CounterSpy trial, you may not be able to run it again. If this is the case, then run the below AVG Antispyware Removal procedure and attach the log later.
AVG Anti-Spyware
•Only run the AVG Anti-Spyware procedure if you could not run CounterSpy. You do not need to run both of these.
Note: If you are using an older Windows OS you may not be able to run some of the above tools! So if you are running Windows 95, 98, or ME run SUPERAntiSpyware and save a log from it so you can attach it. This step is not required if you are running Windows XP, 2K or NT) HOWEVER, no matter what OS you are running, if you could not run CounterSpy or AVG Antispyware then run SuperAntiSpyware.


5: Cleaning Malware


Important Note Before continuing with the below scans:

The best method to remove malware is to do it after booting in Safe Mode with no connection to the internet possible and no browsers running. Booting in safe mode is important because best results are achieved since safe mode disables most drivers and running programs. If you cannot boot in safe mode due to the malware problem then run the scans in normal boot mode but make sure you tell us later in any messages you post.

Thus you will need to print or save these instructons locally in a text file so you can refer to them while offline. Do this before continuing!
•Reboot into safe mode
•Physically unplug your cable to the internet (even if you have dial-up, unplug modem)
•Shut down ALL unrequired applications including browsers
•Run Ccleaner with the default options to clean out temporary files. Only use the Default Scan on the Windows Tab and select Run Cleaner. Do not run any other options from other tabs.
•Run Spybot Search & Destroy and allow it to fix all that it finds. Make sure you use the Immunize feature and use the SDHelper function but do not use Teatimer.
•For Windows XP, 2K and NT users
•Run CounterSpy - Make sure you have it Quarantine all detections! Also attach the log from CounterSpy later if you still have problems. To get the log after scanning. Click View -> Spyware Scan -> View Spyware Scan History. Next click on the scan you want to view, then click view full details of scan. Right-click anywhere in the window that just opened, click on Select All, right-click again select Copy. Now open notepad and right-click anywhere in notepad and select Paste. Now Save As CounterSpy.txt. If you could not run CounterSpy for any reason, run the steps in the following link for AVG Antispyware Running AVG Anti-Spyware and allow it to fix all that it finds. Save the log as requested and attach it later if you still have problems and have to post a message requesting support.
•For Windows 95, 98 and ME users
•you should now run SuperAntiSpyware
6A: Online Virus And Trojan Scanning

Please run the below two online scanning tools and make sure you save and attach the logs later to any request for help that you post. From step 5 you should already be in safe mode but you will need to reconnect your cable now and possibly reboot and choose Safe Mode with Networking Support. If you cannot connect in safe mode for any reason (like dial-up users), run the online scanners in normal boot mode. You will need to use Internet Explorer to run these online scans. Also MAKE SURE YOU HAVE THE LATEST SUN JAVA Version installed by checking against the below link which normally has the most current version. This may help prevent some problems in trying to get these online scanners to run. Before installing the current version, you should uninstall all previous versions first!!!!


*** MAKE SURE YOU RUN BITDEFENDER BEFORE PANDA ACTIVE SCAN ***
*** But if Bitdefender cannot be run then run PandaActiveScan anyway ***


Bitdefender agree to the license and then select Scan. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. Once Bitdefender completes the scan:

Click-on the Detected Problems tab. When the window comes up to save the report, change the Save as type: box to Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click save. This will save a file named bdscan.txt in whatever folder you are currently in when you save the file (take notice of where you are at so you can find it later). This bdcan.txt file will actually contain HTML code that i can easily view later while reviewing your log. All i have to do is rename the file to bdscan.html.

If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to me.

Panda ActiveScan It will only fix certain viruses and trojans. Most items found will not be fixed. When it finishes the scan click on See Report . Then in the next window click Save Report. The default report name is Activescan.txt. Just save it where you can find it so you can attach to your message when you begin a thread with a request for help. If you have any problems trying to get a PandaActiveScan log,If you use Avast antivirus and it gives you and error like below when trying to use Panda, just disable Avast while your run the scan. The error is a false positive.
Do the following and see what happens......