This is a very dangerous breed of malware. Backdoor Trojans, IRCBots and Infostealers
are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge.
Although the backdoor Trojan has been identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS. Please read ""When should I re-format?
All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one.
We will attempt to clean it if you want,but we cannot guarantee it to be 100% safe or secure.
Download Attribune's ATF Cleaner
and then SUPERAntiSpyware
, Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update
Under Scanner Options
make sure the following are checked (leave all others unchecked):Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
Click the "Close
" button to leave the control center screen and exit the program.
DO NOT run yet.
Now reboot into Safe Mode: Safe Mode Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.
to run the program.
Under Main "Select Files to Delete
" choose: Select All
Click the Empty Selected
button.If you use Firefox or the Opera browser click on that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
on the Main menu to close the program.
NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive
Perform a Complete
scan. After scan,Verify they are all
on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes"
and reboot normally.
the removal information after reboot, launch SUPERAntispyware again.
, then click the Statistics/Logs
Under Scanner Logs
, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated
log and press View log.
A text file will open in your default text editor.Please copy and paste the Scan Log results in your next reply.
to exit the program.