HELP NEEDED!! Trojan on my computer!

[CharrHawk164]

Hello Escapees!
Last night I was happily nosing around on my computer when I get a message about BankerFox.A. trying to invade my files. An Antivirus programme has installed itself posing as windows but was just called AntiVirus. The BankerFox.A. is not the virus, I think the 'Antivirus' prgramme itself is.

I have done scans using SUPERSpyWare and Avast! but nothing has been found. When I turn on my computer normally it loads but I get a pop-up saying Windows Security Warning and when I click 'NO' I don't want to start the Antivirus Software it pops up again. I also get a speech bubble saying Windows Security Alert every 30 seconds. Also when I press CTRL+SHIFT+ESC to open Task Manager it closes straight away before I can click on Processes.

I am on safe mode at the moment but there are no suspicious files that I am aware of. Nothing in Task Manager.

Please help!!! THANK YOU!

 

[DazZ.]

Google whatever the program that installed calls itself with "remove" at the end.

It'll give you specific instructions for the exact virus you have.

 

[CharrHawk164]

Google whatever the program that installed calls itself with "remove" at the end.

It'll give you specific instructions for the exact virus you have.

I was doing that last night. They just say "go into Task Manager and remove it from Processes." The problem is that it's not in my Task Manager.

 

[tomtom94]

Spybot Search and Destroy is your friend.

If not, backup your save files and KILL IT WITH FIRE reformat - but only as an absolute last resort.

 

[SNIPERFOX ft. Harry P.Ness]

here you go:

http://www.2-spyware.com/remove-bankerfox-a.html

 

[DazZ.]

Google whatever the program that installed calls itself with "remove" at the end.

It'll give you specific instructions for the exact virus you have.

I was doing that last night. They just say "go into Task Manager and remove it from Processes." The problem is that it's not in my Task Manager.

If it's running on your computer, it's in your processes.

 

[TheEvilCheese]

My brother managed to get that on his Vista a while back (or something similar).
I managed to find some instructions on removing it but Can't remember where...

Bloody annoying thing it is, too.

I'm pretty sure the Fix involved RegEditing and a very specific antivirus program, but I can't remember what it was called. Sorry I can't really be of any help =/


This is why I love running Linux.

*edit* That was it! I had to use Malwarebytes for the removal.

 

[CharrHawk164]

Spybot Search and Destroy is your friend.

If not, backup your save files and KILL IT WITH FIRE reformat - but only as an absolute last resort.

This, absolutely this. Spybot is your best friend for situations like this.

If all else fails, do a system restore to a week ago, might help.

Right Okay I will try this one now. Bloomin' technology! Thank you guys! Here goes...

 

[Iznat]

Spybot - download it (in safe mode) and run the shit out of it.

http://www.fasterpccleanclean.com/remove-bankerfox-a

http://www.spywarevoid.com/remove-bankerfoxa-pop-up-bankerfox-trojan-removal.html

No, really.
Follow those, and get a good antiviral system. I use AVG, but I'm sure there are better ones.
Stop watching illicit porn.

To find the processes, hit ctrl+alt+del to get to the task manager, and there are little tabs up top - applications, processes, services, etc.
Go to processes, and you'll find things ending with .exe
As a rule things like dkewiizkjdks.exe or iddqdops.exe aren't, you know, meant to be there.
Go through lists, see what ones are related to your virus, stop em.
Then follow instructions, and get that fucker out of there.

Bankerfox-a is a password stealer.
Change your passwords, make sure you've not used your credit cards recently.
Can't remember if it's a keylogger or not.

 

[macacos2]

Make a trojan yourself to fight off trojans

 

[CharrHawk164]

Make a trojan yourself to fight off trojans

Oh wow that's such a plan. If only I was a pc whizz I would.

 

[CharrHawk164]

Spybot Search and Destroy is your friend.

If not, backup your save files and KILL IT WITH FIRE reformat - but only as an absolute last resort.

This, absolutely this. Spybot is your best friend for situations like this.

If all else fails, do a system restore to a week ago, might help.

Right Okay I will try this one now. Bloomin' technology! Thank you guys! Here goes...

It wont install. It says it can't connect with the server?

 

[moretimethansense]

Have you tried Spybot Search and Destroy or Malwarebytes yet?

I had a similar problem a while ago called Anti Virus 2010, it claimed I had a number of viruses and that I had to purchess it to get rid of them, I wasn't fooled of course but it disabled my net connection for a while so I had to get a mate to download Malwrebytes for me, if that doesn't work, in the absolute worst case scenario format the bastard and start fresh, back up your important files first though.

 

[Continuity]

Google whatever the program that installed calls itself with "remove" at the end.

It'll give you specific instructions for the exact virus you have.

I was doing that last night. They just say "go into Task Manager and remove it from Processes." The problem is that it's not in my Task Manager.

If it's running on your computer, it's in your processes.

may not be a program, could be a driver, a service, a DLL or something devious. Not to say it is mind, just that not everything appears in the task manager.

 

[DazZ.]

Google whatever the program that installed calls itself with "remove" at the end.

It'll give you specific instructions for the exact virus you have.

I was doing that last night. They just say "go into Task Manager and remove it from Processes." The problem is that it's not in my Task Manager.

If it's running on your computer, it's in your processes.

may not be a program, could be a driver, a service, a DLL or something devious. Not to say it is mind, just that not everything appears in the task manager.

If it's popping up on your screen and making noises, it'll be in the processes.

Edit: Obviously not everything shows in the Task Manager, but what I said before does make it look like I meant that.

 

[Sinclair Solutions]

Send the Achilles and the Greeks. Clear that shit right up.

 

[Continuity]

If it's popping up on your screen and making noises, it'll be in the processes.

Obviously not everything shows in the Task Manager...

My point is that if its a driver or a DLL you may not see a new process in the task manager because it may be running as a part of one of your normal processes.

 

[DazZ.]

If it's popping up on your screen and making noises, it'll be in the processes.

Obviously not everything shows in the Task Manager...

My point is that if its a driver or a DLL you may not see a new process in the task manager because it may be running as a part of one of your normal processes.

Yeah I'm being blunt/a dick because I feel rough.

What I said before did make it sound like I meant absolutely everything would be in the Task Manager specifically.

Edit: I'll attempt to be helpful instead.

They just say "go into Task Manager and remove it from Processes." The problem is that it's not in my Task Manager.

Here is a list I found of processes your lovely new virus uses, remove these from your processes as apparently this is what it calls itself.

Spoiler: Process List

aazalirt.exe
dkekkrkska.exe
dkewiizkjdks.exe
iddqdops.exe
ienotas.exe
iqmcnoeqz.exe
irprokwks.exe
jikglond.exe
jiklagka.exe
jrjakdsd.exe
jungertab.exe
kitiiwhaas.exe
kkwknrbsggeg.exe
klopnidret.exe
krkdkdkee.exe
krkmahejdk.exe
krtawefg.exe
krujmmwlrra.exe
ktknamwerr.exe
kuruhccdsdd.exe
ooorjaas.exe
oranerkka.exe
oropbbsee.exe
otnnbektre.exe
otowjdseww.exe
otpeppggq.exe
rkaskssd.exe
ronitfst.exe
seeukluba.exe
skaaanret.exe
sysguardn.exe
tobmygers.exe
tobykke.exe
zibaglertz.exe
sysguard.exe

 

[CharrHawk164]

I installed MalwareBytes on safe mode and scanned. It restarted and everything appears to be back to normal.

THANK YOU ALL FOR YOUR AMAZING HELP! Would have ended up throwing my laptop out the window if iy weren't for your help! =D

 

[the.chad]

Always good to do a second scan after a restart in case the issue keeps refreshing.
I've ran into a few nasties that, despite being removed, auto-installed themselves on a restart.