Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Need help to remove infostealer.bank.c

  • Please log in to reply
1 reply to this topic

#1 Tearingmyhairout


  • Members
  • 1 posts
  • Local time:07:41 PM

Posted 31 March 2009 - 12:15 PM

I hope some can help me with a Virus/Trojan problem I have. My knowledge of all things computing is pretty basic to say the least, so don’t fear you will be insulting me by offering an ‘idiot’s guide’ solution!

I had loads and loads of error messages telling me that my email to various locations had failed (I hadn’t been sending any emails btw). I shut everything down, restarted my PC and ran my virus scanner (Norton Antivirus).

It listed 3 instances of something called ‘INFOSTEALER.BANK.C’, which needed to be removed manually as apprently it cannot be removed automatically. I was directed to the Sysmantec website for instructions.

It told me to insert my windows CD and restart using the Windows Recovery Console, delete a load of stuff, update virus definitions, run a full scan, then delete values from Registry. It all seemed pretty involved to me!

Anyway, I failed at the first hurdle! The CD I received with the PC is called the ‘Product Recovery CD’ No where on the CD could I finds an option to restart using Windows Recovery Console, as suggested on the Sysmantec site.

The PC and CD date back to 2001 when I bought the machine. I am running Windows XP Home Edition.

Is there any other way of resolving this problem and deleting the offending virus?

How dangerous is this virus?

I have tried to download or run serveral other online virus/trojan removers, but I think the bugs are blocking this - I either get the "cannot open page" message, or a pop-u saying "The system administrator has set policies to prevent this installation"

All suggestions gratefully received - I'm hoping that I don't have to reinstall Windows XP as I got a lot of stuff on here and I gather I will lose everything. Is there someway of removing these things without re-installing Windows?

BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,897 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:41 PM

Posted 31 March 2009 - 01:25 PM

Infostealer.Banker.C is a Trojan horse that may steal sensitive information from the compromised computer.

symantec.com (click the details tab for more)

If your computer was used for online banking, has credit card information or other sensitive data on it, you should disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. You should change each password using a clean computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connect again.

Please download hosts.zip and save it to your Desktop.
  • Extract (unzip) the file to its own folder C:\hosts. (Click here for information on how to do this if not sure.)
  • Open up the hosts folder and double-click on the mvps.bat file.
  • The script will rename your present HOSTS file to HOSTS.MVP and copy the new HOSTS file to the correct location on your system.
  • You can read more about what we are doing in Blocking Unwanted Parasites with a Hosts File.
    Note: You may have to overwrite the hosts file in "Safe Mode" if you get "an access denied message" when trying to do it in normal mode.
MVPS HOSTS File Install Instructions with screenshots if you need them.
Hosts File FAQ

Please download and scan with Dr.Web CureIt.
Follow the instructions here for performing a scan in "safe mode".
If you cannot boot into safe mode, then perform your scan in normal mode. Be aware, this scan could take a long time to complete.
-- Post the log in your next reply.

Please download Malwarebytes Anti-Malware (v1.35) and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

-- If you cannot use the Internet or download any programs, try downloading from another computer (family member, friend, etc). Save to a flash (usb, pen, thumb, jump) drive or CD, transfer to the infected machine, then install and run the program. If you cannot copy files to your usb drive, make sure its not "Write Protected". Some flash drives have a switch on the side which could have accidentally been moved to write protect.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users