simonrex22

I got a virus a couple days ago. Norton detected it and it says Trojan Horse Hkbamfge.exe

Norton, Spybot, or Adaware cannot get rid of it. It is constantly giving me pop up ads and changing my internet settings. Does anyone know how i can get rid of this.

vinaur

Did you try booting in Safe Mode and running Norton, Spybot, Adaware?

bendsley

Google has no record of that file name. Sure you typed it in right?

__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."

trache

Download Hijackthis. This program is most effective at getting important startup information where Trojans tend to hide out.

Actually, while you're at it you'll want to download the install/setup files and update files for Ad-Aware a recent AntiVirus program (AVG is excellent), and Spybot.

Then, boot into Safe Mode:

At your Windows desktop, go to your Start menu and then select Shutdown. Select Restart from the pop-down menu. Your system will then restart. Before the operating system starts to load ("Welcome to Windows! Please Wait"), hit the F8 key. You will be shown a menu with choices, one being Safe Mode (do not select Safe Mode with Networking for now); choose that one. Wait for your computer to finish its booting process.

Login as the administrator user if you can.

Install all of the above software.

Run Hijackthis and save the log file. Restart your computer in safe mode with networking. Log into TFP and post the contents of your Hijackthis logfile. We will help you with the things that you'll need to click to remove in order to begin removing this trojan horse. <-- important, you do not want to screw up your system by deleting lines you shouldn't, so let the technical-type people tell you what to do here!

Restart into Safe Mode (without Networking).

Run another Hijackthis scan and remove all the items that you were told to remove. Run Ad-Aware, Spybot and then run a virus scan with your anti-virus software with all the updates (You did remember to download the individual updates and install them while your computer is not connected to the Internet did you not?). After all is said and done, restart into safe mode again and do the above once more. Post your Hijackthis log file, wait for our response and then run Ad-aware, Spybot and your virus scanner again. Once you're sure things are OK, boot into normal mode and do it again (Yes, this is annoying, but well worth the time and effort).

The best advice I could give to you is to make sure you have a hardware firewall sitting in front of your computer(s) while all of this takes place. That way, viruses that are making their rounds on the Internet have a very difficult time of infecting your computer while you're trying to save it. They can be purchased for $50-200 at most business/office supply stores, Radioshack, or computer outlet. To scare you even more, I believe I read that the average infection time for a brand new Windows PC connected to the Internet directly (ie no hardware firewall) is about 2-3 minutes!

After all is said and done, make sure you visit Microsoft WindowsUpdate and update your operating system.

__________________
"You looked at me as if I was eating runny eggs in slow motion." - Gord Downie of The Tragically Hip

simonrex22

Thanks, i'll give that a try.

drakers

Yeah I got a virus over a week ago and it competely fucked up my laptop. I guess the limewire filesharing program I downloaded really had spyware. Which I was careful to pick one that didn't. Guess that didn't work. Well, one night it just took over, like a bitch with an axe. Couldn't do a damn thing. Had to reload my settings on my computer. I bought Norton and Webroot Spy Sweeper. It had been a godsend, I notice now how much spyware you get from just surfing the web. It is ridiculous.

__________________
Friends don't shake hands, friends 'gotta HUG!

zynyxx

Just another thought to add...
some of the existing trojans rename themselves and respawn whenever a proper shutdown is done. (By clicking Start, shut down,...). So you may try, if the other suggestions don't work, after cleaning in safe mode, unplug the system. Normally I wouldn't suggest this, but it did work for me with one trojan. (can't remember the name of it right now).

simonrex22

Hey drakers, i dont know what your looking for with a filesharing program. But ive been using one called BearShare for music and it doesnt have any popups and i havent had a single problem in almost a year. I think its at bearshare.com but you can google it if its not.

simonrex22

Ok, i tried to run Hijackthis. First i cant get windows to start up in Safe Mode. All i get is text on the screen that says Multi/Disk/Partition/Windows/System32 or something like that. And when i try to run Hijackthis, all i get is Not Responding errors and it freezes.

dksuddeth

go here, run the scan.

http://housecall.trendmicro.com/

__________________
"no amount of force can control a free man, a man whose mind is free. No, not the rack, not fission bombs, not anything. You cannot conquer a free man; the most you can do is kill him."

vinaur

Open Task List (Ctrl+alt+del), go through the list and check what are all the processes that are running. AnswersThatWork.com has a nice list of a lot processes and suggestions on what to do with them.

trache

The first description sounds exactly like Safe Mode. Questions:

Did you manage to get the Windows Boot Menu up on your screen - the one that asked you how you wanted to start up?
Did you select the correct option (Safe Mode)?

If you did, you then might be asked which Windows you want to load (if you have multiple partitions, but don't worry about this one just select the only option you have on-screen at that time).

After you select that, the screen should go black and then whiz by a few lines of things like:

Multi(0)Partition/Blah Blah Blah/windows/whatever/

after that, Windows should load into Safe Mode. You'll select your user name, and after the operating system gets you to your desktop, a little popup window should tell you that you're in Safe Mode.

Can you restart into safe mode again, describe what steps you took and what was on your screen when you made your selections (and what happened afterward)?

When you're in Safe Mode, Windows should not load anything that is not "default" (to Windows). That means potential trojans have of a less chance of loading in Safe Mode. I have always been able to run the programs I need in Safe Mode, while having the programs that are trouble not load at all. There may be something amiss, but you'll need to describe to us exactly what you see etc.

The Safe Mode boot screen with the Multi(0) lines isn't needed, but make sure you let us in on everything else.

I would say that if it's not responding that you should wait a bit. What version of Windows are you running, and do you have any service packs installed with it?

__________________
"You looked at me as if I was eating runny eggs in slow motion." - Gord Downie of The Tragically Hip

simonrex22

I'll try to get into Safe Mode again. I may have missed something.

Im running Windows XP. I just downloaded updates, so im not sure what or if i have a service pack.

trache

If you can, go into the Start Button -> (Settings...) -> Control Panel -> System Control Panel (it may be under the "maintenance and performance").

In the "General" Tab you'll see a section that says "System". You will see a brief overview of your system, with service pack level (if you have one, if you don't it will not say anything).

__________________
"You looked at me as if I was eating runny eggs in slow motion." - Gord Downie of The Tragically Hip

simonrex22

Thanks for all your help, but my dad is going to take over on trying to fix this.