Trojan Horse Problems

[cobra8ball]

Hi....

I have Vx2.ZSERV and the eXact.downloader showing up and wreaking havoc. OK...I am not sure what happened but 2 days ago I noticed some pop ups starting, I did virus scan using Norton 2004 professional, I have used Spybot S&D, Adaware, and even Microsofts new anti-spy program, and a couple of others I tried that ended up costing if you wanted to remove problem. By the way the Microsoft program is the only one that gave me the option and said it was removed from my system. However after reboot it rears its ugly head again. Every time I or anyone gets on the net the pop ups etc...etc...start all over...And a system restore back to Saturday is not possible since I turned it off and did several scans to get out of that restore file if it was there. Please, does anyone know of a utility that will rid me of this for good? Or am I doomed...............I spent hours Monday night running scans and trying to eliminate the problems.......If more information is needed please just leave me a note and I will provide. Windows XP Home is the operating system for this computer.

HELP!!!!..........Thanx Cobra

 

[aquias]

First things first try out downloading and running Hijackthis and post your log file up here.

Hijackthis download

http://www.spychecker.com/download/download_hijackthis.html

And a bit more information below on somethings

Okay here's what I found on this...

Looks as if this gives a listing of .exe's and registry changes that are made by vx2.zserv

http://www.webhelper4u.com/transponder/zserv.html

Possible removal tool?

http://www.noadaware.net

Okay for the eXact.Downloader...

Other possibilities, ensure that you do not have C:\WINNT\system32\exclean.exe on your system still.

 

[bcastner]

This is a genuine pain to remove. Killbox can help:

http://www.lavasoftsupport.com/index.php?showtopic=54511

 

[jimp56]

also, cant the vx2 cleaner plugin for the latest ad-aware help?

http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml

Not to mention (hate to keep harping on this) that

http://housecall.trendmicro.com

does a pretty good job (in general) of ridding you of the reinfecting trojans before cleaning the other components.

so i would run housecall first, reboot, then run any of the tools suggested to clean up vx2.

 

[bcastner]

The Adaware VX2 cleaner only works on the older variants. I do not know of an automatic cleaner utility for the newer VX2 variants, including the Microsoft Antispyware Beta tool, which admits in its forums that it cannot clean the new VX2.

 

[jimp56]

thanks, i figured it would be too good to be true if that one tool would keep working on the new variants. good to know.

 

[cobra8ball]

Hi....

I want to Thank everyone who responded to my problem. A friend came over and we were able to get rid of this, which I am very happy about. Again, I Thank You for your help and response.....

Cobra........