Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Estalive Removal


  • Please log in to reply
3 replies to this topic

#1 orangeburgr4

orangeburgr4

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:10:12 AM

Posted 01 August 2007 - 07:51 AM

The trojan Estalive (AdWare.Win32.IEHlpr.e[Kasperksy], Trojan.SmartAllYes [Symantec]) is embeded in my computer. I have Spyware Doctor, CA Antispyware, TrojanHunter, TrojanRemover installed on my computer and CAs AntiSpyware is the only one that regularly detects it. I tell the program to delete it but, it keeps coming back. Also, I constantly changes the scan schedule in the program. As this goes on, it changes my IE settings so that the other spyware programs cannot access the internet, and eventually, I can't get online either. I have to go into IE settings and restore defaults. That lasts about 4 hrs., then I have to do it again. I have wiped the hard drive and reinstalled the OS several times, and all of these programs that are supposed to keep things like this from ever entering my computer don't work. This insidious thing keeps coming back. Can anyone offer any help?

BC AdBot (Login to Remove)

 


m

#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:12 AM

Posted 01 August 2007 - 10:08 AM

Have you tried doing your scans in "SAFE MODE"?

If so and that did not help, then download and scan with Dr.Web CureIt. Follow the instructions here for performing a scan.

When done, download and scan with SUPERAntiSpyware Free for Home Users.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 foxymosh

foxymosh

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:12 PM

Posted 01 August 2007 - 10:16 AM

Hi there, Can I first confirm with you that you have a firewall installed, this is essential. I have not tried any of the software you mentioned but i use and reccomend the free antivirus AVG, available from grisoft.com. Hoefully the following info with help you to rid the virus,

1) after running the antivirus/antispyware, write down the exact location and name of the virus, as you will have to manually delete this.
2) run your computer in safemode, after switching on computer press and hold F8, and from menu choose SAFEMODE
(its important to delete virus in safemode)
3) when in safemode goto file of virus and manually delete and then go to recycle bin and delete again, if virus is in registry, run regedit, START, type REGEDIT and find the named virus and delete.
(I reccomend that you do a back up of your registry first)
Then restart computer and run antivirus again, you may have to repeat the above.

Hope this has been of help to you.

#4 buddy215

buddy215

  • BC Advisor
  • 12,605 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:08:12 AM

Posted 01 August 2007 - 11:12 AM

You may be interested in seeing the fix found in post #5 in the link below.
http://forums.techguy.org/security/511392-...ive-help-i.html

Since you may be getting reinfected from frequently visiting a site using IE and it appears to be an Active X malware, you may want to install and use Firefox with the NoScript extension which will protect you from driveby installs and ActiveX malware.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users