Help
The trojan Estalive (AdWare.Win32.IEHlpr.e[Kasperksy], Trojan.SmartAllYes [Symantec]) is embeded in my computer. I have Spyware Doctor, CA Antispyware, TrojanHunter, TrojanRemover installed on my computer and CAs AntiSpyware is the only one that regularly detects it. I tell the program to delete it but, it keeps coming back. Also, I constantly changes the scan schedule in the program. As this goes on, it changes my IE settings so that the other spyware programs cannot access the internet, and eventually, I can't get online either. I have to go into IE settings and restore defaults. That lasts about 4 hrs., then I have to do it again. I have wiped the hard drive and reinstalled the OS several times, and all of these programs that are supposed to keep things like this from ever entering my computer don't work. This insidious thing keeps coming back. Can anyone offer any help?
Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Page 1 of 1
Trojan Estalive Removal Estalive deeply embeded in registry
Back to top
#2
- Bleepin' Janitor
-
- Group: Global Moderator
- Posts: 25,111
- Joined: 09-July 05
- Location:Virginia, USA
Posted 01 August 2007 - 10:08 AM
Have you tried doing your scans in "SAFE MODE"?
If so and that did not help, then download and scan with Dr.Web CureIt. Follow the instructions here for performing a scan.
When done, download and scan with SUPERAntiSpyware Free for Home Users.
If so and that did not help, then download and scan with Dr.Web CureIt. Follow the instructions here for performing a scan.
When done, download and scan with SUPERAntiSpyware Free for Home Users.
Microsoft MVP - Consumer Security 2007-2012 
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
Member of UNITE, Unified Network of Instructors and Trusted Eliminators
#3
- New Member
-
- Group: Members
- Posts: 1
- Joined: 01-August 07
Posted 01 August 2007 - 10:16 AM
Hi there, Can I first confirm with you that you have a firewall installed, this is essential. I have not tried any of the software you mentioned but i use and reccomend the free antivirus AVG, available from grisoft.com. Hoefully the following info with help you to rid the virus,
1) after running the antivirus/antispyware, write down the exact location and name of the virus, as you will have to manually delete this.
2) run your computer in safemode, after switching on computer press and hold F8, and from menu choose SAFEMODE
(its important to delete virus in safemode)
3) when in safemode goto file of virus and manually delete and then go to recycle bin and delete again, if virus is in registry, run regedit, START, type REGEDIT and find the named virus and delete.
(I reccomend that you do a back up of your registry first)
Then restart computer and run antivirus again, you may have to repeat the above.
Hope this has been of help to you.
1) after running the antivirus/antispyware, write down the exact location and name of the virus, as you will have to manually delete this.
2) run your computer in safemode, after switching on computer press and hold F8, and from menu choose SAFEMODE
(its important to delete virus in safemode)
3) when in safemode goto file of virus and manually delete and then go to recycle bin and delete again, if virus is in registry, run regedit, START, type REGEDIT and find the named virus and delete.
(I reccomend that you do a back up of your registry first)
Then restart computer and run antivirus again, you may have to repeat the above.
Hope this has been of help to you.
#4
- Forum Addict
-
- Group: BC Advisor
- Posts: 4,491
- Joined: 14-April 06
- Gender:Male
- Location:West Tennessee
Posted 01 August 2007 - 11:12 AM
You may be interested in seeing the fix found in post #5 in the link below.
http://forums.techguy.org/security/511392-...ive-help-i.html
Since you may be getting reinfected from frequently visiting a site using IE and it appears to be an Active X malware, you may want to install and use Firefox with the NoScript extension which will protect you from driveby installs and ActiveX malware.
http://forums.techguy.org/security/511392-...ive-help-i.html
Since you may be getting reinfected from frequently visiting a site using IE and it appears to be an Active X malware, you may want to install and use Firefox with the NoScript extension which will protect you from driveby installs and ActiveX malware.
Share this topic:
Page 1 of 1