I have two Trojan viruses that AVG can't remove. Where to now?

Question

I am running Windows XP and remember that there is a back-dating function for removal of viruses but forgotten how to access it. Any help would be appreciated.

Answer 1

Malware may still be lurking in your system restore volumes so it would be in your best interests to disable system restore, reboot then re-enable system restore when you log back on. What this does is protects you from reloading the malware should you ever need to do a system restore.

Many anti-virus products cannot remove viruses from system restore thus the reason for clearing out possible infected points. For reference to this, see the link below:

Problems with System Restore

There are some problems associated with System Restore when it comes to viruses. When restore points are created they are stored in a directory that is accessible only to the System account and not to a user. This keeps the restore points safe from misuse and tampering. Unfortunately this also means that any virus scan software you may have installed can not scan the files located there as well. This causes a problem if a file that is infected with a virus gets backed up into a restore point because now the anti-virus software can not clean it. Now if you ever restore from a restore point, that file that is infected will be introduced back into your system.

http://www.bleepingcomputer.com/tutorials/tutorial56.html#problems

After rebooting, run another scan to see if the malware still exists. If yes, follow these steps.

Firstly update and run your anti-virus product. You can also run a free online scan as well as some malware can actually corrupt or disable your resident security products. Here are a few online scans you can run:
Trend - http://housecall.trendmicro.com/
Panda - http://www.pandasoftware.com/products/ActiveScan.htm
Norton - http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Second download, update and run scans using the following products:
SuperAntispyware
http://superantispyware.com/
Spybot S&D (free version requires manual updating)
http://www.safer-networking.org/en/download/
AVG AntiSpyware
http://free.grisoft.com/doc/20/lng/us/tpl/v5
Adaware from Lavasoft (free version requires automatic updating)
http://www.lavasoftusa.com/products/ad-aware_se_personal.php

(These programs can be run in Safe Mode after downloading and updating)

Third, after cleaning your system, disable System Restore, reboot and re-enable System Restore when you log back on. This will clear the malware that may still be lurking in System Restore, which could be reinstalled should you need to rollback at some point. Additionally, a reboot may be required to complete the malware removal process.

Lastly, you may also want to install the following tool. It is free and requires you to check for and enable updates manually once a week or so. It uses no system resources.
SpywareBlaster (inoculates, not a spyware removal tool)
http://www.javacoolsoftware.com/spywareblaster.html
================================
If you cannot get it removed after the above, you may want to join a tech group that specializes in providing manual instructions on malware eradication.

Free technical help forums

AumHa Forums
http://aumha.net/index.php
Bleeping Computers
http://www.bleepingcomputer.com/forums/
Spybot S&D Forums
http://forums.spybot.info/
Lavasoft Forums
http://www.lavasoftsupport.com/
Spyware Info Forums
http://forums.spywareinfo.com/index.php?showtopic=79038
GeekstoGo
http://www.geekstogo.com/forum/forums.html

Answer 2

try a different anti virus or update your anti virus there might be a update for the anti virus program to remove it also you might just be using avg anti virus try installing the antispy ware that gets rid of spy ware ad ware and Trojans if this doesn't work just format your computer or take it to it they will doo it for you but make shore you have try ed everything before you take it to the experts by the way the date backing program is called system restore it can easily be found by clicking start all programs accessories system tools and system restore will be in there if it is not go start and do a search on system restore click on the icon with the magnifying glass

Answer 3

Have you tried an online scanner?
If not try
http://housecall.trendmicro.com

I use them sometimes when one just doesn't want to clean with my AVG.

Seems that no anti virus is 100% so sometimes an on line scan from another source will help.

You can also download the system cleaner from them if the online doesn't work.

Answer 4

search and destory program would remove those
also AVG has another program that will help remove them.
window xp olny has a firewall and a backup-restore system that is when your computer gose nuts you can restore it to the other time when it was going good,

Answer 5

Hi. The back-dating method (System Restore) will not remove your virus(s). You might try an online scan to identify them, then Google to find out how to remove them.

Answer 6

Format and do clean installation.

Answer 7

call the Geek Squad, they'll help you out.

Answer 8

Apparently you are using Grisoft AVG Antivirus ? Generally you should get a message explaining you need to reboot into Safe Mode in order stop the malware as a running process enabling you to safely and entirely remove it. This is very, very common for some severe trojans and viruses. You may have to only perform this once or twice in a lifetime. Note that with very inferior products (which AVG is not, one of the best) this is a general response with no instructions apparently.

So I am trying to convey simply what is going on and that this does not mean that AVG is not able to remove it. Generally, paid subscription antivirus programs immediately block and delete trojans because they are known threats and there is nothing that is valid in the entire package - so the user is loosing nothing, plus they take over the pc in various ways. Many times spyware also employs trojans in installations. I suggest two attacks at the trojan. First the easy way and then if not then Safe Mode (very easy).

1) Install the following, update to latest defintions and perform the scan and remove it. This is one of the best malware removers in the world with well over 300 thousand defintions for all different types of malwares and specializes in trojan removal:

a-squared trojan remover (Free Working Version for life and Proactive Premium Version)
http://www.emsisoft.com/en/software/free/
a-squared (a-squared) is a complementary product to antivirus software and desktop firewalls on MS Windows computers. Antivirus software specializes in detecting classic viruses. Many available products have weaknesses in detecting other malicious software (Malware) like Trojans, Dialers, Worms and Spyware (Adware). a-squared fills the gap that malware writers exploit. Automatic updates: In a-squared Free the updater must be run manually. The auto-update feature of a-squared Personal checks hourly for new available updates and installs them automatically. a-squared Free is freeware! You can download and use it completely for free. You are also allowed to distribute it to third parties. To be able to use it, you only must set up a free a-squared Account, to get access to the update server. (Note you register by simple sign up to activate definitions downloads free).

2) If that gives the similar message - you definately need to reboot into the Windows diagnostic mode - Safe Mode. This only allows a basic start up of Windows and allows security software to perform scans and removal when necessary (rare). You cannot access the internet in Safe Mode and do not run anything at all but the security software (antivirus, antispyware) to remove the threat and reboot into Normal Mode when finished. Here's how:

Click > Start (lower left) > Run > type in " msconfig " and > Okay > the diagnostics panel opens...
Click > BOOT.INI > SAFE MODE.... click all the okay windows to reboot into Safe Mode and absolutely touch nothing else - everything is automatic. You are going into Safe Mode to do your business and get out. Make sure you have your latest updates for antivirus and antispyware first.

The computer reboots into Safe Mode and click Okay at start. Open your antivirus program and run the full scan. If you are sure you were told it was a trojan by your antivirus program then use antivirus. If you were using AVG antispyware then scan with that first. When you are done with quarantining or deleting any threats found, it is time to reboot back into Normal Mode - as normal.

To reboot when finished removing malware in Safe Mode....

Click > Start > Run > type in msconfig > Okay > General Tab click > NORMAL .... click everthing okay to reboot into Normal Mode. Touch absolutely nothing else. The computer will now reboot into its normal running mode with the threat(s) removed. Done !

TIP: Download this Symantec How to Boot into Safe Mode file to your desktop so you can easily refer to it when in Safe Mode if you forget anything - or just copy/paste these instructions into a text file to your desktop for easy access in Safe Mode.

FILE: (Right click this Link and choose "Save Target As" > Desktop or My Documents):

How to go into Safe Mode:
http://www.bluecollarpc.net/downloads/SafeMode_WindowsXP.rtf

Webmaster http://www.BlueCollarPC.Net

Further problems ? join any of our groups:

MEMBERS:
http://www.bluecollarpc.org/_mgxroot/page_10734.html

ANTIVIRUS FREE HOME VERSIONS
(Note only paid subscription antivirus activates real time protection, none of the free programs):

AVG Anti-Virus Free Edition [working-freeware]
http://www.grisoft.com/
AVG Free Edition is the well-known antivirus protection tool. AVG Free is available free of charge to home users for the life of the product. Rapid virus database updates are available for the lifetime of the product, thereby providing the high level of detection capability that millions of users around the world trust to protect their computers. AVG Free is easy to use and will not slow your system down (low system resource requirements). Highlights include automatic update functionality, the AVG Resident Shield, which provides real-time protection as files are opened and programs are run, free Virus Database Updates for the lifetime of the product, and AVG Virus Vault for safe handling of infected files.

ClamWin Free Antivirus [Open Source - working freeware]
http://www.clamwin.com/
ClamWin is a Free Antivirus for Microsoft Windows 98/Me/2000/XP and 2003. ClamWin Free Antivirus comes with an easy installer (and open source code). You may download and use it absolutely free of charge. It features: High detection rates for viruses and spyware; Scanning Scheduler; Automatic downloads of regularly updated Virus Database. Standalone virus scanner and right-click menu integration to Microsoft Windows Explorer; Addin to Microsoft Outlook to remove virus-infected attachments automatically. The latest version of Clamwin Free Antivirus is 0.88.2.3 . Please note that ClamWin Free Antivirus does not include an on-access real-time scanner. You need to manually scan a file in order to detect a virus or spyware.

Avast AntiVirus Home Edition [working-freeware] http://www.avast.com/eng/avast_4_home.html
Free avast! 4 Home Edition. avast! 4 Home Edition is a full-featured antivirus package designed exclusively for home users and non-commercial use. Institutions (even non-commercial ones) are not allowed to use avast! Home Edition. However, ALWIL Software provides the full line of avast! antivirus products at special discount prices for non-profit, charity, educational and government institutions. Please see our price lists for details.