Question

Trojan Infection

for approx 6 weeks I have been infected with a Trojan, I use Avast which has never identified it, but Microsoft Malicious removal tool does identify it and remove it. The problem is, it continues to be reloaded every so often. It appears right after I get this notice -
regsv32.exe - Application Error - I run removal tool - finds it -removes it. The files found are:
Trojan:Win32/Kotver.gen1a and Trojan:Win32/Kotver.clreg
it causes all sort of goofy things like hard drive constantly engaging among others and once before I found it my computer wouldn't even reboot for a day after restart/after restart, thankfully it finaly did and I was able to diagnose the problem. How to identify how it keeps reappearing and stop it is my concern before something really drastic happens. Thanks in advance

Discussion is locked

Follow
Reply to: Trojan Infection
PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.
Reporting: Trojan Infection
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Comments
- Collapse -
Answer
Please Try This...

Follow the instructions in the link below to the letter.

“Expand” the post titled: "Please try this" at the link below:
http://www.cnet.com/forums/post/f742c795-5881-433b-a29b-6d758efe5cd3/

It would also help us to know exactly which file is being identified as malware and which operating system you're using, make and model of the computer, etc..The detections you've listed are for registry key detections and not necessarily files that are infected although clearly something is dropping the malware on the machine so the reg keys are being created. After performing the scans in the link above, try checking this item. Occasionally, the infected file or key is located in the System Restore files and as such, most removal tools can't clean it. Therefore, temporarily disable System Restore to remove all the infected versions of the files, then re-enable SR again.

Hope this helps.

Grif

Post was last edited on September 27, 2016 12:08 PM PDT

- Collapse -
Trojan Infection

Thanks for the response. Here is all that I can tell you for fact. The two register keys I identified are unfortunately all the info that the Win removal tool gives me. My computer is a Lenovo 64bit I purchased in 2013, running Win 8.1. I downloaded Win 10 but was completely unhappy with it, and reloaded the 8.1. I also notice that the beginning of this error occurred when I recieved a screen display that said there was an error in the Firefox browser, and to install this patch, which I of course did. I have since deleted that file, reloaded the latest version of Firefox and still occasionally still get that message popping up. I have tried to use Google Chrome more and I don't recall if the error screen shows only when I am on Firefox or not. I have never restored my computer from a restore file, so I don't think that is an issue, however there may be more involved than I am aware of. I am not a PC geru by any stretch. I come from a mainframe background, so have some skill but have never truly dug into the PC platform. I have tried to trace that message about Firefox and various other things to no avail. I have narrowed the infections found are in the user/roamingdata area.

- Collapse -
And there is a way to expunge that area.

Create a new user account (make it an admin) and move to the new account.

I'll add here that no Windows machine should ever be used with a single admin account. Always have a spare to fix things that go bleep.

- Collapse -
You Don't Need To Actually Use System Restore...

...to have the detection to continue to occur. Most malware removers simply can't remove things from the System Restore files and as such, the malware will continue to be found even after some of the cleanup tools are used. Therefore, please use the removal tools in the link I provided and also temporarily disable SR, then re-enable it.

Hope this helps.

Grif

- Collapse -
Sounds like it's in system volume Grif.

Dafydd.

CNET Forums

Forum Info