Trojan horse Trojan/Dldr.Small.bbn

Please run virus and spam software. They will find and clean up this stuff efficiently. There is no point to trying to self-diagnose these files. There are thousands out there with new ones each day.

Hello eriew:

I run each, one at a time and really can't figure why I keep getting Trojans, which is why I thought they may originate from my own machine.

appreciate your reply. The 'cleaners I use are: Ad-Aware 2007/Ad-Watch 2007; Spyware Doctor combining Antivirus; Regcure, with all these fully up to date.

Prior to downloading Spyware Doctor/Antivirus, I used Kaspersky Antivirus, then AVAST!.

Having recently had serious Trojan and virus Infection, I could not understand how the same Trojan was repeatedly turning up after running Ad-Aware, so decided to look deeper to see if there was any hidden files. The one that keeps coming almost every-time I clean in a Trojan called [ExtendedEngine] (part of this Trojan I pasted in my original post).

My machine keeps freezing every few minutes. I need it at the moment because I am looking for another flat, which has to be in the next three weeks. So I can't afford to totally reinstall Windows. In case I get it wrong.

stay safe

babybear

Trojans and spyware and adware often times write themselves to your registry.

After running your anti-spyware programs, it will remove the intruder from your RAM but not the registry and as a result will come back each time you reboot your computer.

To resolve this you have to run your computer in Safe Mode. This will allow you to operate your computer using the minimum amount of resources needed to run your computer and you can access and remove unwanted programs from your registry.

You can google any trojan or virus and get all kinds of information on how to remove them.

Sometimes you might get a false trojan and some outfit will try to sell you a remover to get rid of it and they happen to be the only ones that can get the trojan. Be mindful of those scams.

If your anti-spyware, anti-virus programs aren't picking it up, maybe your list needs updating or maybe they need to update theirs. Make a copy of your registry of the infected files and send it to them. There happens to be a site that takes you through the process, I don't remember what it is called but I'm sure someone on this forum knows and can fill you in on it.

That's the site I put the link to!

Yes, Hijackthis.

Thank you. I didn't have time to read all the posts.

Hello Janissaries:

I have run in safe mode, but cannot get the by pressing F8 or similar. That was a week ago.

I have since gone deeper and found some files that are said to be nasty. That is the ones above written as notepad. I now have un-installed the Ad-Aware anti spyware. I have got rid of all the links I can find to the anti-spyware I un-installed. Though I was surprised the RegCure did not find the links I had made of the anti-spyware in the menus and start menu. I have deleted all these now.

I downloaded Spyware Doctor a week ago and, this is combined with antivirus. So I will now get into safe mode and run the Spyware Doctor and RegCure.

I actually found the files I typed in bold at the start of my thread, after either Spyware Dr or RegCure listed them. That was yesterday-Thursday 04/09/08.

I knew I had to go into safe mode but was never sure why. Your explanation help, thanks. You're a real helpful lot on here you know! Thanks.

Lastly I often forget to log-off so if it appears I am on-line I may not be, and in fact may be running the cleaning tools so cannot get on line. So sorry about that.

It will be interesting to note if the safe mode clean will find the files I mention above? I will find out in a few hours.

babybear

Just another note:

Windows XP has you identified as a server by default. You might want to turn that feature off to be less susceptible to virus attacks, especially if you leave your computer on all the time.

I was told once how to do but it wasn't so much the focus of conversation or an issue at the time for me to remember how it was done.

Hello BB, I got stuck with a Trojan a few months back and found the people at this site very helpful!

http://www.webuser.co.uk/forums/postlist.php/Cat/0/Board/hijackthis

follow their instructions and your machine will be back on the straight and narrow! Good luck mate!

Truman

Hello Mr. Truman Brain:

I have just found this, which was classed as a very high critical threat:[Flooder.Java.NewsAgent.F] which was a Hijacker.

I am hoping it was my stupidity in not RECONFIGURING the Spyware Dr/antivirus combined app, after I had put my machine into 'safe mode' to try and find all the threats I might have. Anyway I have now configured Spyware Dr/antivirus combined app and I can now use the computer..............Don't know how long it will last mind!!!

With the Flooder....... I googled it and it has lots of aliases. Most nothing like the previous, if you see what I mean. It came out in Feb 2008, thats just in case anyone may be reading this .....to help them!

The Trojan I mention in my original post on this thread was a proper Trojan and I did not paste it's full name as I was not sure if it could reinfect from that full name, you know? The Flooder was in a Ahead\Nero Dr.web.dll.

Thanks for your kind words I will now run other software to see if I can find anything else............I hope not, but is is getting a real nuisance. I wish I could find the hole they are sliping through!

stay safe

babybear

Hello Mr. Truman Brain:

hope you are fine?

I have run, and run, and run the RegCure and Spyware Doctor. Though I know roughly where the files listed above S3kg.C - notepad etc, but I am still looking for them as I have not seen them mentioned as one of the several viruses which have been cleaned up.

When I was looking for and cleaning up any files I copied from the web, I found a couple which were related to a virus starting aarw..........which was almost the same as the Ad-Aware 2007 app name.

I don't know if I did right but, I brought the page up on screen and using the mouse, CUT short bits of the virus name to try not to spread it on my machine again. As I did this the whole picture changed on screen and it went back to a basic view. It was as if I had restored it. Seem to have lost quiet a lot of files from MY DOCUMENTS.

I again run the RegCure and Spyware Doctor several times. Then, re-configured the screen colours etc. The MENUS on the left of the screen have also altered and, instead of reaching the top of the screen they are only about two thirds up now.

On the plus side.......... I have not had a CRASH since everything altered. However my entire screen still goes black for about a second every now and then. It does not seem to stop anything working though.

This is what I do not understand:...............On RegCure after cleaning lots of times it tells me I have 2 EMPTY REG KEYS, and gives me the names of something that look like they are related as the KEYS are IDENTICAL.

THESE ARE THE DETAILS:

(1).......[\s-1-5-21-1482476501-1767777339-839522115-1003\Software\Microsoft\CTF\Assemblies]

------------------------------------------------------------------

(2).......[\s-1-5-21-1482476501-1767777339-839522115-1003\Software\Microsoft\SAPI Layer]

Is there any way I can mend these empty REG KEYS? These empty keys cause other keys to empty and I have to use the RegCure every 30 minutes to mend everything. But it will not mend the two missing keys.

Many thanks to all who read this for the advice!!!

I will visit the site you and others recommend. But, am not sure what the CLEANER mentioned does? Can you tell me?

stay safe

babybear

I would go through the msconfig to make sure you are not loading any programs not required or desired and full scan for viruses. Do a full disk clean up, remove cookies and temp internet files.

If you find it and remove it and it doesn't come back great.(Perhaps clean up your virus vault as well?) If not I would re-start the computer in safe mode and do a full scan.

I find that AVG 8.0 is a good free antivirus software that also will notify you of spyware.

If these don't work you can always physically remove the hard drive that has the problems and put it into another machine as a slave and do a full scan on the drive itself. I have never yet had to resort to this to remove viruses but I hear it is the best way to make sure everything is clean.

Hope it helps.

Hello GroovyCBR:

Firstly, a general thank you to all as all suggestions were helpful!

I have been working all day using all the cleaning apps I have. I have dumped an anti-spyware app as I have one in Spyware Doctor.antivirus.

I do not pretend to be an expert in using the safe mode but, I did my best. And can always go back into safe mode when and if I need to.

Before I started I got rid of cookies, and temp files and history. And some services and programs.

How can I clean up the virus vault without reinfecting?

I have two HDD and have in mind to change from the current one used for Windows, to the other and start using a different OS and browser. However, there is almost 50gigs to sort out and, I do not want to dump programs which may stop my computer working properly.

It has not worked this fast for a long time! I know I have only been using it for an hour since the safe mode clean...........Lets hope it stay like this. I still have in mind to get rid of the files above, which were said to be critical, but want to leave things as they are for a couple of days as I have a lot of work to do, and, do not want to screw things up!

The four files I list above have still not been found by the apps I have. So I will try the 'cleaner' as mentioned by another poster, and please forgive me for not remembering your name.........................I am going to bed now so any other replies will be tomorrow. Thanks once again to all!! I do not think I am hope and dry yet but say, halfway there.

stay safe

babybear

PS> Do you think I should stop using the phrase 'stay safe'? Doesn't work for does it?

Hey BB,

Use what ever make you feel good! If it's right for you then it's right for me! Glad to hear your machine is feelin a little better!

Hello Nigh,

thank you for the BT thing. I am not too worried at the moment about the speed I get but, have copied all posts here to remind me.

I went into the 'System Configuration Utility'. I cannot seem to get into safe mode from the 'F8' or any others. Is the Utility the same as 'safe mode?

stay safe

babybear

System utility is not the same as safe mode. System utility lets you select what you want to run when you next restart the computer, safe mode starts with the minimum drivers & applications.

Are you holding the F8 key whilst your PC restarts, that usually does it but some PCs read this as a stuck key & get all upset. In this case you have to keep tapping the F8 key as the PC restarts. If this fails, reboot normally & windows may recognise that you failed to get into safe mode & give you the options screen.

I could be wrong but I think some computers F5 will work too? (to initiate safe mode) (must be depressed and held after restarting computer as it boots)

Hello GroovyCBR:

Thanks for the post.............................I have read the way to get into safe mode as the computer starts is, to keep pressing F12. In your post you say to hold the F5 button down. I have not tried the 'holding down' bit yet but, will do, thank you.

Now, can you please shoot me as I am a danger to others but, especially myself!!......

The reason...........I went to find the Windows/Microsoft update site. And, I clicked on a site that was masquerading as the windows/Microsoft site.

The symptoms were the RegCure said faults found - 2, faults mended - 16 ! Then I lost my Microsoft email account, and the screen or desktop went into 'classic'.

Spyware Doctor found what I think is all of the problem bits which were screwing my machine up from the Registry. And also certain files disappeared from the desktop, like My Computer and My Documents, and the trash bin was on the right side of the screen............away from all the other icons.

I knew there was something wrong and, did a restore, which actually worked!!!!

The restore got me back my email account and replaced the missing icons on the desktop.................

I have yet to visit the site which explains what things do and why. Can't recall the name sorry. But it was something like fixit?

I have run RegCure and Spyware Doctor and I intend to get AVG but, have not got it yet.

It seems to be running fine at the moment..........fingers crossed!!!

I have changed the theme to green, so I can see straight away if something changes. It has changed, or sort of 'flipped' in the passed and still came back on with the same theme I usually have which is the 'silver' one. Now I have the green XP theme, is helped me to see and confirm problems when they happened.

Thanks for your help..............

stay safe

babybear

lol perhaps you need something with good internet security

At least your system restore worked for you.

An easy way to make sure you are updating thru winblows... click Tools on IE7 and midway down you will see Windows Update. Never click on a pop up even if it looks from a legit site as most legit companies won't use such software (Popups).

Good luck!

Anti-virus, malware & ad-ware software won't always find trojans & root-kits, you need to use a dedicated programme like The Cleaner.

Hello Nigh,

I thought as you were kind enough to mention the cleaner program I should write and thank you OK? What does this program do? Can you tell me?

Please read the stuff I wrote to mr brain (approx name), sorry mr brain.

stay safe

babybear

babybear,

The Cleaner works like other anti-spy & anti-virus programmes but it is configured to look specifically for trojans which a lot of other programmes will not find. I run it every few weeks on my home PC, it's a bit slow in operation & needs to re-start after updating but I've been using it ever since I had a problem some time ago that got through the firewall, anti-virus & anti-spy software I had at the time. The Cleaner found & fixed that problem & has been in my arsenal ever since.