Help with getting rid of a virus...

Canon EF 24-105mm f/4.0L IS

05/02/2009 09:39:19 PM · #1

I am currently running AVG and AdAware and they both tell me that I have a Win32TrojanNsAnti virus. I was hoping someone could tell me how to get rid of this. I am guessing it has embedded itself in the Registry because it seems to reappear every in a day or two after being quarantined or healed. Can anyone walk me through or point me to a trusted tutorial that can help me eradicate this? It seems like it is a bit of a process, needing HijackThis logs and editing the registry. I am not really sure how to do this stuff so any advice would be great. Thanks
Joe

JoeCan30d

Canon EOS-1Ds Mark III

05/02/2009 10:01:16 PM · #2

You can try this

//www.removal-instructions.com/removeTrojan.html

I found it doing a goggle search on "How to remove Win32TrojanNsAnti virus"

jstrong

Canon EOS-5D

Canon EF 24-105mm f/4.0L IS

05/02/2009 10:24:25 PM · #3

Try //download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

jano

Carl Zeiss 50mm ZE f/1.4 Planar T for Canon

05/03/2009 01:12:49 AM · #4

Originally posted by JoeCan30d:

You can try this

//www.removal-instructions.com/removeTrojan.html

I found it doing a goggle search on "How to remove Win32TrojanNsAnti virus"

I saw that company, but I was a little nervous to use as I searched for spyhunter and Spybot Search and Destroy shows it as malware. A little resaerch and this was why. From there Forums...
Hello,

The reasons why Spybot - Search & Destroy detects this software as malware are several ones:
There are anti-spyware tools like 1stAntivirus, AdsAlert, ADS-Remover, AdwareAlert, ADWAREBazooka, Adware-Patrol, AdWare Pro, AdwarePunisher, Adware Remover, AdwareSheriff, AdwareSpy, AdwareX Eliminator, AgentSpyware, Alfacleaner, Antispywaresoldier, Antivirus Gold, AntiVirusPro, BPS Spyware Remover, DiaRemover, Doctor-Adware-Pro, Easy-Spyware-Killer, ErrorGuard, ETD-Security-Scanner, EyeSpyNow, Goodbye-Spy, KillSpy, NoAdware, PC-Health-Plan, Pestbot, PSGuard, PurityScan, Registry Cleaner, Repair Registry Pro, ScanSpyware, Spionfrei, SpyAxe, SpyBlocs, SpyCleaner, Spycontra, Spydeface, SpyDestroy-Pro, SpyFalcon, SpyGuard, SpyHeal, Spyhunter, SpySherrif, SpySpotter, SpywareBomber, SpywareBot, SpywareCleaner, SpywareNO!, SpywareSoftStop, SpywareStormer, SpywareStrike, SpywareQuake, SpyQuake, Trek Blue Error Nuker, Trojan-Guarder, TrueSword, Virusblast, WareOut, WinAntivirusPro2006, WinFixer, WinHound, WorldAntispy, X-Con-Spyware-Destroyer, X-Spyware, XSRemover, YourSoft-AntiVS or YourSoft-AntiVT which have a very dubious or bad character. They state to be an anti-spyware tool but employ questionable advertising methods: In the form of a PopUp they offer a scan of your system. They refer you to an infection of viruses and spyware on your system which is actually not true, because the listed items are not really on your pc. After downloading the software you can only scan for the threats. If the threats (pseudo-infections) are detected you have to register first and pay (up to $30) in order to remove them. Some of these dubious anti-spyware tools do also create a toolbar in IE and create recurring PopUps.

THanks for that though. Going to keep searching...
a

Originally posted by jstrong:

Try //download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

jano

Looks promising. Will try that soon if spybot doesn't fix it.

Do people know if trojans attach to the registry, how to get rid of them?
Thanks for the Help!

yanko

Canon EOS-5D Mark II

05/03/2009 01:59:15 AM · #5

If you haven't already done so DISABLE system restore otherwise even if you fix the problem it may keep returning as the virus gets saved in one of windows restore points.

Photologist

Apple iPhone 14 Pro Max

Canon EF 70-200mm f/2.8L IS USM

05/03/2009 02:06:34 AM · #6

Originally posted by yanko:

If you haven't already done so DISABLE system restore otherwise even if you fix the problem it may keep returning as the virus gets saved in one of windows restore points.

Don't permanently disable System Restore. Only disable it while you use your anti-virus software to clean your system, ridding it of viruses. Afterwards, you can perform a manual restore point, then delete all but the latest restore point. This way, you still have the protection of using System Restore once your system is clean, and also free-up some disk space.

yanko

Canon EOS-5D Mark II

Carl Zeiss 50mm ZE f/1.4 Planar T for Canon

05/03/2009 02:28:09 AM · #7

Originally posted by AperturePriority:

Originally posted by yanko:
If you haven't already done so DISABLE system restore otherwise even if you fix the problem it may keep returning as the virus gets saved in one of windows restore points.

Don't permanently disable System Restore. Only disable it while you use your anti-virus software to clean your system, ridding it of viruses. Afterwards, you can perform a manual restore point, then delete all but the latest restore point. This way, you still have the protection of using System Restore once your system is clean, and also free-up some disk space.

Right. I should have mentioned that.

Sony 16-50mm f/3.5-5.6 E-mount

05/03/2009 03:57:38 AM · #8

So I am now running a bunch of virus scans with system restore disabled, if it finds the problems and quarantines them. Then do I return the system restore, or restart and the enable system restore?

Hipychik

Sony Alpha a6000

05/03/2009 04:10:55 AM · #9

OMG DUDE! I just went through this. The guy that that fixed me up, downloaded a program called CCleaner and superanti-spyware. I'm not sure what else he did but give these a try.

Sony 16-50mm f/3.5-5.6 E-mount

05/03/2009 04:16:33 AM · #10

cool, I will look at those next. :)

Hipychik

Sony Alpha a6000

05/03/2009 04:19:30 AM · #11

It's so annoying! I tried everything I could think of and finally had to call someone out to fix it for me. Mine was a vundo trojan.

Marston

Canon EOS-5D

Canon EF 24-105mm f/4.0L IS

05/03/2009 05:02:05 AM · #12

Try this link
//www.safer-networking.org/index2.html
It is free to download they just ask for a donation.I have used it for a couple of years and found it very good.There is no advertising or third party stuuff involved.