Help I think my computer has been infected with a trojan

[Holly]

My father is a scumbag computer guy who has done several
illegal and unethical acts with his own computer, and
those belonging to others. He was here at my home on
Thanksgiving, and he kept trying to get access to my
computer.

Several times he told me about this "great new program
that will help your system run faster." Both my husband
and I told my father SEVERAL times, no way. Well, while
I was setting the table and my husband was carving the
turkey, we got wind that my dad was in our computer room.

He jumped up immediately when my husband walked in. I
was suspicious, but didn't have time to check things out
until now. I went into our computer's Event Viewer and
saw that he tried to load a program
called "newsticker.exe"

I entered this into a search engine and related pages say
it is a remote trojan backdoor thing that will allow him
to get onto our computer. I am now terrified that he has
done something, or will do something very soon.

I am running Windows XP, and I immediately did a System
Restore on it, back to the day before Thanksgiving. I
checked all my folders for this file "newsticker.exe", as
well as the one the websites told me it would have
created, "glonk.wnk". Neither of these seem to be
present, but I am still scared. What else can I check?

I am not all that computer savvy, thought I have learned
some things due to my dad's activities. Please help me!
What else should I do to protect myself, and to make 100%
sure that this newstick program is not in use on my
computer?

Holly

 

[Molly]

Hey Holly, I also am not computer savvy, but I did
somehow get some trojan download viruses on my computer.
I ran my Norton and was able to delete 2 of the 3. The
last I am pretty sure is gone, as a subsequent virus scan
doesn't show it. I went into my Microsoft Explorer
settings and deleted all of my temporary internet files
and cleared all of my history. Maybe it would work for
you also. Good Luck!

 

[Doug Knox MS-MVP]

Holly,

Where did you do your search for "newsticker.exe"? The only things I've
been able to find are in German, and one reference to www.iway.com (chain of
cyber cafes in India).

The best defense against trojans and virus infections is to keep your
antivirus software updated and scan your system regularly. Also become
familiar with the items listed in the Startup tab of MSCONFIG and the items
that are normally running in Task Manager.

 

[Holly]

Doug, I'm sorry, the program name was newstick.exe I
went to www.metacrawler.com and searched for "newstick
program" and it came up on several sites as a backdoor
access thing.

We have symantec, norton antivirus software that we
purchased when we got our computer last year, and we
renewed our subscription in October. That's all I really
know about it.

Holly

-----Original Message-----
Holly,

Where did you do your search for "newsticker.exe"? The only things I've
been able to find are in German, and one reference to

www.iway.com (chain of

 

[Doug Knox MS-MVP]

All you can really do, Holly is to check for the signs of infection that are
listed on the antivirus sites.

http://vil.nai.com/vil/content/v_98800.htm

is one such.

 

[Holly]

I did do a search for the two file names that are
mentioned, and I found neither of them after doing the
system restore. (I don't know if they were present
before the restore, I didn't check.) I am still so
jitery though, I can't believe this has happened!
Hopefully though my computer is ok. I am running a full
computer virus check right now using my Norton Program.
So far, nothing.

Keeping my fingers crossed. Thanks for the help!

Holly

 

[Holly]

Molly, thanks! I am doing a virus scan right now, and so
far, nothing. After that is done I will go in and delete
my old Temp internet files.

Thanks for the tips!

Holly

 

[Kent W. England [MVP]]

You did the exact right thing. No matter what your father installed,
running a System Restore back to a prior time point will undo whatever
he did.

Since you have XP, you can password protect all your accounts so that he
can't logon at all. Do this and you won't have to watch him when he
visits.