Trojan DyFuCA problems

[Adi]

Hi, Experts!
I have Trojan DyFuCA and no antitrojan remove it. I try 8-10 antitrojan
programs, without success.
If I manualy delete and clean register, after restart its there again.
Is any program to remove this before I go to drastic works (format all
discs).
Thanks!
(e-mail address removed)

 

[Gerry Cornell]

What anti virus program are you using?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[David H. Lipman]

From: "Adi" <[email protected]>

| Hi, Experts!
| I have Trojan DyFuCA and no antitrojan remove it. I try 8-10 antitrojan
| programs, without success.
| If I manualy delete and clean register, after restart its there again.
| Is any program to remove this before I go to drastic works (format all
| discs).
| Thanks!
| (e-mail address removed)
|

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

Dump the contents of the IE Temporary Internet Folder cache (TIF)

start --> settings --> control panel --> internet options --> delete files

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Ad-aware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Trend Sysclean Method 1
---------------------------------------
Create a directory.
On drive "C:\"
(e.g., "c:\sysclean")

Download SYSCLEAN.COM and place it in that directory.
Download the signature files (pattern files) by obtaining the ZIP file.
For example; lpt526.zip

Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.

Trend Sysclean Method 2
---------------------------------------
The utility SYSCLEAN_FE in "Procedure 1" at the following URL
http://www.ik-cs.com/got-a-virus.htm automates the download and execution process of the
Trend Sysclean Package.

2) Update Ad-aware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode and shutdown as many applications as possible
5) Using both the Trend Sysclean utility and Ad-aware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point

* * Please report back your results ! * *

 

[Sharon F]

Hi, Experts!
I have Trojan DyFuCA and no antitrojan remove it. I try 8-10 antitrojan
programs, without success.
If I manualy delete and clean register, after restart its there again.
Is any program to remove this before I go to drastic works (format all
discs).
Thanks!
(e-mail address removed)

Have you looked up the directions for manual removal yet? Suggest doing so.
Those directions should walk you through the steps needed to get all parts
of the trojan so that it does not reinstall itself.

 

[Kelly]

These will. Run the combo:

Run Ad-Aware SE, Spybot and HijackThis:
http://www.majorgeeks.com/downloads31.html

Note: Update the first two programs, once installed, before running.

--
In memory of our dear friend, MVP Alex Nichol: http://www.dts-l.org/

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Steve N.]

These will. Run the combo:

Run Ad-Aware SE, Spybot and HijackThis:
http://www.majorgeeks.com/downloads31.html

Note: Update the first two programs, once installed, before running.

I had a machine with that stinker on it last week and it took several
scans with all three tools in safe mode, rebooting between scans, to
finally get rid of the tenacious little creep.

Steve

 

[Kelly]

Hi Steve,

Odd indeed. Ad-Aware alone catches it every time in normal mode for me.
For the next time, check this path:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main and delete
Band Rest.

BTW, ever tried to figure out what it stood for? )

--

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[Steve N.]

Hi Steve,

Odd indeed. Ad-Aware alone catches it every time in normal mode for me.
For the next time, check this path:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main and delete
Band Rest.

There were a lot of other infections, not just dyfuca, but that sucker
just kept re-infecting after each reboot. I don't recall the exact steps
I had to take but it did involve registry editing and several scans in
Safge Mode before it was gone. This was one of the worst messes I've
ever seen, over 1,000 spyware items and something like 30 different
viruses. It was a wonder the thing booted up at all and it took me about
a day & a half to clean it up.

BTW, ever tried to figure out what it stood for? )

Nope. What does it stand for?

Steve

 

[Adi]

After 5 day hard work without success, today do and remove this Trojan after
updated Microsoft Antispyware removed it. I check 5 restart of system and
DyFuCA is gone.

(e-mail address removed)