how to remove trojan virus? Closed

Question

Configuration: Windows Vista / Firefox 3.6
plssssss help me!

Ambucias · Answer

Hello,

Please explain for there are different remedies for different Trojan Horse.  What are the symptoms?

Please download  and install Hyjackthis 2.0.3 (Beta)

http://free.antivirus.com/hijackthis/

Request a scan and save a log.  Copy the log and paste here.  We will see what we can do for you

Best regards

Ambucias · Answer

Hello,

Sorry but you have work in front of you.  You probably got your system infected by downloading some freeware.

Please follow the instructions hereunder, you may wish to print them:

1.Click the Start menu, select Run.
2.Type taskmgr.exe into the the Run command box, and click "OK." You can also launch the Task Manager by pressing keys CTRL + Shift + ESC.
3.Click Processes tab, and find BAT.Looper processes.
4.Once you've found the BAT.Looper processes, right-click them and select "End Process" to kill BAT.Looper

c:\Documents and Settings\All Users\Application Data\927e\unins000.exe
c:\Documents and Settings\All Users\Application Data\927e\VDoca582.exe 

Delete the following DLL's

How to delete BAT.Looper DLL files:

1.First locate BAT.Looper DLL files you want to delete. Open your Windows Start menu, then click "Run." Type "cmd" in Run, and click "OK."
2.To change your current directory, type "cd" in the command box, press your "Space" key, and enter the full directory where the BAT.Looper DLL file is located. If you're not sure if the BAT.Looper DLL file is located in a particular directory, enter "dir" in the command box to display a directory's contents. To go one directory back, enter "cd .." in the command box and press "Enter."
3.When you've located the BAT.Looper DLL file you want to remove, type "regsvr32 /u SampleDLLName.dll" (e.g., "regsvr32 /u jl27script.dll") and press your "Enter" key

c:\Documents and Settings\All Users\Application Data\927e\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\927e\sqlite3.dll

Delete the following looper files:

1.Click your Windows Start menu, and then click "Search."
2.A speech bubble will pop up asking you, "What do you want to search for?" Click "All files and folders."
3.Type a BAT.Looper file in the search box, and select "Local Hard Drives."
4.Click "Search." Once the file is found, delete it

c:\Documents and Settings\All Users\Application Data\927e
c:\Documents and Settings\All Users\Application Data\927e\unins000.dat
c:\Documents and Settings\All Users\Application Data\927e\Languages
c:\Documents and Settings\All Users\Application Data\System Data Configuration\config.cfg
c:\Documents and Settings\All Users\Application Data\System Data Configuration\DB.ini
c:\Documents and Settings\All Users\Application Data\System Data Configuration\fsvd6398.db

1.Select your Windows menu "Start," and click "Run." An "Open" field will appear. Type "regedit" and click "OK" to open up your Registry Editor. 
2.Registry Editor will open as a window with two panes. The left side Registry Editor's window lets you select various registry keys, and the right side displays the registry values of the registry key you select. 
Ensure to back up your registry.
3.To find a registry key, such as any BAT.Looper registry keys, select "Edit," then select "Find," and in the search bar type any of BAT.Looper's registry keys. 
4.As soon as BAT.Looper registry key appears, you can delete the BAT.Looper registry key by right-clicking it and selecting "Modify," then clicking "Delete." 

%UserProfile%\Application Data\Virus Doctor
%UserProfile%\Application Data\Virus Doctor\settings.ini
%UserProfile%\Application Data\Virus Doctor\uill.ini
%UserProfile%\Desktop\Virus Doctor.lnk
%UserProfile%\Start Menu\Virus Doctor.lnk
%UserProfile%\Start Menu\Programs\Virus Doctor.lnk
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Virus Doctor.lnk
c:\Documents and Settings\All Users\Application Data\927e\Languages\VDDe.lng
c:\Documents and Settings\All Users\Application Data\927e\Languages\VDFr.lng
c:\Documents and Settings\All Users\Application Data\927e\Languages\VDIt.lng
c:\Documents and Settings\All Users\Application Data\927e\System Data Configuration
c:\Documents and Settings\All Users\Application Data\927e\System Data Configuration\DBInfo.ver
c:\Documents and Settings\All Users\Application Data\927e\System Data Configuration\vd952342.bd
c:\Documents and Settings\All Users\Application Data\System Data Configuration 
%UserProfile%

Click on start, run, type regedit, ok

Delete the following entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Virus Doctor"
%UserProfile%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Doctor_is1
%UserProfile%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "URVDoc[]" 
%UserProfile%\Application Data\Virus Doctor\

To get your homepage back:

1.Click Windows Start menu > Control Panel > Internet Options.
2.Under Home Page, select the General > Use Default.
3.Type in the URL you want as your home page (e.g., "https://www.realty101.com/").
4.Select Apply > OK

Good luck

How to remove trojan virus?

2 responses

Similar discussions

Subscribe To Our Newsletter!