SPARC Forums

Main Forums => Father's Issues => Topic started by: I cry_ in_the_dark on Mar 23, 2004, 01:09:53 PM

Title: OT- Need help from a computer "wiz"
Post by: I cry_ in_the_dark on Mar 23, 2004, 01:09:53 PM
My anti-virus picked up some Trojans the other night, and healed them. I since receive the message Trojan Downloader.Stubby.B is found in file C:\System Volume Information\_restore( witha  bunch of numbers).

My virus scanner is not finding any current virus.
I cannot find any information on this Trojan.
Can anyone help me out?
Title: RE: OT- Need help from a computer
Post by: Peanutsdad on Mar 23, 2004, 01:34:20 PM
Ok, since you picked up a trojan,, odds are good there are other items on your puter that need sanitizing.


lavasoft.com   download and install adaware, run it,, let it kill off any adware, trojans, and dialers it finds.


You can also get it here   http://www.tucows.com/preview/236049.html

Spybot search and destroy is also highly recommended to get the ones adaware doesnt, I run both programs. It can be found here   http://www.safer-networking.org/
Title: RE: OT- Need help from a computer
Post by: I cry_ in_the_dark on Mar 23, 2004, 01:51:31 PM
Thanks, running Microtrend right now to see if that picks it up. I have adaware already. I'm just finding it odd that my antivirus picked it up, cleaned it, but am getting this volume message.
Title: RE: OT- Need help from a computer
Post by: NoNicky on Mar 24, 2004, 06:55:33 AM
If that does not find it try Symantec or MacAfee.  I believe both of them have short-lived trial programs available.  One of them would surely find it.  

NoNicky
For God has not given a spirit of fear; but of power and of love and of a sound mind.  1 Peter 1:6
Title: Do This!
Post by: jurroppi1 on Mar 25, 2004, 05:11:19 AM
You can go to symantec.com and see if there's a specific program availiable to remove the trojan that remains in your system, although it looks like there isn't one to me. Update your virus scanner data files to the most recent ones you can find. You'll need to turn off system restore, because NO virus scanner will clean infected files that reside inside restore points, which is what's still wrong. Of course, turning off system restore will wipe out all of your restore points as well, but that's something you'll have to deal with to get rid of this trojan. Then run the virus scanner, then turn system restore back on.
Title: RE: Do This!
Post by: I cry_ in_the_dark on Mar 26, 2004, 02:28:20 AM
No, I couldn't find any programs to remove it either....(Stubby.A     yes, but this appears to be a different strain.) I've tried everything.

How do I turn off/on my system restore?

Are you saying that I would not be able to restore  prior to this date when I do turn it off?

Thanks for your help.
Title: RE: Do This!
Post by: jurroppi1 on Mar 26, 2004, 05:27:27 AM
Q: "How do I turn off/on my system restore?"

A: Go Here [A Href=http://securityresponse.symantec.com/avcenter/venc/data/pf/[email protected]" Target="new]Symantec Online Tutorial for How to remove W32.Goner.A@mm[/A] Don't worry, there is info on how to disable system restore near the bottom of the page if you're using Windows ME.

If you're using XP, then go to Start>Control Panel>System
In the system properties page, click the system restor tab, and check Turn Off System Restore On All Drives.

Then turn it back on when you're done (uncheck it).

Q: "Are you saying that I would not be able to restore prior to this date when I do turn it off?"

A: Yes, you won't be able to restore to any previous time prior to when you turn it back on again after disabling it and running your AV program, the re-enabling it. Sorry, that's an issue you can't get around if you want to erradicate this trojan from your system, it's stuck in one of your restore volumes and this is the only way to remove it from there. Unless you follow the link to the Microsoft KB article (linked in the symantec Tutorial, and use the FIFO method outlined therein). If it were me; I'd just disable it, get rid of the trojan, and then re-enable it.

Good luck to you :)
Title: RE: Do This!
Post by: I cry_ in_the_dark on Mar 26, 2004, 02:48:35 PM
Ok...I did that just now.....we'll see what happens. My antivirus did not detect anything.
Title: RE: Do This!
Post by: I cry_ in_the_dark on Mar 27, 2004, 09:18:38 AM
I think it worked. No pop up windows this morning which is what has been happening.

Thanks so much!!!
Title: RE: Do This!
Post by: jurroppi1 on Mar 28, 2004, 05:38:12 AM
Happy to help. take care :)