Trojan Horse

[Connie]

Can anyone assist me in removing a Trojan Horse called
Second Thought? It resides in Program
files\STC\slmnss.exe. I get a message saying to remove
it, run AVG for Windows. I have done this several times.
It does find it and it says it's removed but it remains.
I can locate it in explorer and remove the individual
files but it still comes back. I've downloaded several
Trojan Horse removal tools but none really get rid of it.
I use AVG anti-virus and Kerio Firewall. I'm getting so
many hits on the firewall I've been forced to disable it.
Can anyone help me? Thanks in advance! Connie

 

[Carey Frisch [MVP]]

Symantec Security Check
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Virus Removal Tools
http://securityresponse.symantec.com/avcenter/tools.list.html

Online Virus Removal Tutorials
http://www.symantec.com/techsupp/virusremoval/virusremoval_info_tutorial.html

Computer viruses: description, prevention, and recovery
http://support.microsoft.com/default.aspx?scid=kb;EN-US;129972

There is a very helpful virus removal newsgroup you may wish to post to:
news://msnews.microsoft.com/microsoft.public.security.virus

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/

-------------------------------------------------------------------------------------


| Can anyone assist me in removing a Trojan Horse called
| Second Thought? It resides in Program
| files\STC\slmnss.exe. I get a message saying to remove
| it, run AVG for Windows. I have done this several times.
| It does find it and it says it's removed but it remains.
| I can locate it in explorer and remove the individual
| files but it still comes back. I've downloaded several
| Trojan Horse removal tools but none really get rid of it.
| I use AVG anti-virus and Kerio Firewall. I'm getting so
| many hits on the firewall I've been forced to disable it.
| Can anyone help me? Thanks in advance! Connie

 

[Rick]

Connie, Step by step

1. Download and install HijackThis from here:
http://www.spychecker.com/program/hijackthis.html

There are many settings in the registry that need to be modified and posting
the log file to specialist forums like: http://forums.techguy.org will get
you some specific directions. Alternatively, you can email your HijackThis
log to me and I'll go through it.

2. Once those changes are made you should download and install a copy of
AdAware from here: http://www.lavasoftusa.com/support/download/ and run it
on your system using these customized settings:

Click "Use custom scanning options" then click "Customize" and have these
options selected: Under Drives and Folders put a check by Scan within
archives and below that under Memory and Registry put a check by all the
options there. Click on the Tweak button in that same window. Under Scanning
engine select "Unload recognized processes during scanning" and under
Cleaning Engine select "Let windows remove files in use at next reboo"t.

Select all the found items, click next and finish. Restart the coupter.
The restart is important, don't skip!

3. Download and install SpyBot from here:
http://spybot.eon.net.au/index.php?lang=en&page=download. Run SpyBot and
let it fix all problems. Restart the computer.

4. Buy me a cold beer.

Rick

 

[Connie]

Thanks for the websites, Carey!
Connie

 

[Connie]

You got the cold beer, Rick. What's your brand? ;-)
Thanks for the step by step info!
Connie

-----Original Message-----
Connie, Step by step

1. Download and install HijackThis from here:
http://www.spychecker.com/program/hijackthis.html

There are many settings in the registry that need to be modified and posting
the log file to specialist forums like:

http://forums.techguy.org will get

you some specific directions. Alternatively, you can email your HijackThis
log to me and I'll go through it.

2. Once those changes are made you should download and install a copy of
AdAware from here:

http://www.lavasoftusa.com/support/download/ and run it

on your system using these customized settings:

Click "Use custom scanning options" then

click "Customize" and have these

options selected: Under Drives and Folders put a check by Scan within
archives and below that under Memory and Registry put a check by all the
options there. Click on the Tweak button in that same window. Under Scanning
engine select "Unload recognized processes during scanning" and under
Cleaning Engine select "Let windows remove files in use at next reboo"t.

Select all the found items, click next and finish. Restart the coupter.
The restart is important, don't skip!

3. Download and install SpyBot from here:
http://spybot.eon.net.au/index.php?

lang=en&page=download. Run SpyBot and

let it fix all problems. Restart the computer.

4. Buy me a cold beer.

Rick

 

[Rick]

Your welcome . . . pass the Silver Bullet

Rick