Help me remove a Trojan! ("FakeAlert-T")

Ugh.

Let me begin by pointing out that I am completely computer illiterate.

Yesterday, my computer picked up an annoying piece of spyware known as "FakeAlert-T". I use McAfee virus protection, but this thing still got through. There's info on it on the McAfee site, including removal info, but I don't know how to apply it.

Can anybody walk me through this?

Info here: http://vil.nai.com/vil/content/v_143406.htm

Let me conclude by pointing out that I am completely computer illiterate. Thank you.

Uh... this is not at all what I thought this thread was going to be about.

That being said, the link at the bottom of the page you linked to looks like the first step to removing this malware. Do you have technical support through McAfee?

Get Spy-Bot Search and Destroy and Ad-Aware SE.

According to that link, all you have to do is open your McAffee scanner, run the update, and then run a scan. The new virus definitions should find and remove that "virus."

I have Virus Scan Plus. I don't think it includes technical support. I called customer service and the tried to sell me the Gold phone suppert for $69.95 where the walk you through it over the phone or Platnum $89.95 where they remotely access the computer and do it. I think that my call was processed in India as we had some serious communication issues.

I tried this: :http://www.removeonline.com/remove-trojan-horse-fakealert-t-trojanhorsefakealertt-removal-instructions/

which generated a report and then offered to fix it for $39. Can I use the report info and just remove the files manually?

I've also heard about using Hijackthis to generate a log, which I can run if necessary.

Johnboyjjb wrote: According to that link, all you have to do is open your McAffee scanner, run the update, and then run a scan. The new virus definitions should find and remove that "virus."

I've done that, but it keeps coming back.

I've downloaded the DATs, turned off System Restore (I use XP) and re-run the scan, to no avail.

http://www.removeonline.com/remove-trojan-horse-fakealert-t-trojanhorsefakealertt-removal-instructions/

I did a google and found this. Looks free.

never mind I see you tried that and it's not free after all. Did you try to manually unregister the .dlls associated with the trojan?

http://www.removeonline.com/pc-tutorial/

EastCoastMojo wrote: http://www.removeonline.com/remove-trojan-horse-fakealert-t-trojanhorsefakealertt-removal-instructions/ I did a google and found this. Looks free. never mind I see you tried that and it's not free after all. Did you try to manually unregister the .dlls associated with the trojan? http://www.removeonline.com/pc-tutorial/

Um, no. How do I do that?

From the first remove online link, it looks like they are saying that these .dlls and .exe are associated with that trojan:

uesiuqcr.exe
C:\WINDOWS\system32\msziptools.dll
C:\WINDOWS\system32\smwin32

The second remove online link gives this info for un-registering these files:

HOW TO UN-REGISTRY DLL FILE :

Please go to “Start” and then click on “Run”
Now in the Run command box, type “cmd“, and then click on “OK”
Type “regsvr32 /u filename.dll” where “filename” is the name of the file that you like to Unregister.

I make no claims about the accuracy of the info provided by this site, just passing on the info.

Do you know exactly when you got the trojan? If so, you might be able to do a system restore?

EastCoastMojo wrote: Do you know exactly when you got the trojan? If so, you might be able to do a system restore?

I got it yesterday afternoon. Are you suggesting I restore the system to, say, two days ago?

http://www.malwarebytes.org/

/thread.

Woody wrote:

EastCoastMojo wrote: Do you know exactly when you got the trojan? If so, you might be able to do a system restore?

I got it yesterday afternoon. Are you suggesting I restore the system to, say, two days ago?

That might do it.

How do I do it?

Go to Start > All Programs > Accessories > System Tools > System Restore

It will ask you if you are looking to make a restore point or restore to an earlier point in time. Select the 'earlier point in time' option and click next. Look on the calendar that comes up for a date that is bold. Bold days are points that you can restore to. Pick one that is before the malware was installed on your machine.

Eh, scratch that. A little google searching found that it will not get rid of the trojan.

Have you tried the link that GRtechguy posted?

Somehow, I missed his post. I'm currently running another McAfee scan, so I need to wait until that's done before I can download malwarebytes.

This is getting aggravating. I think I'm going to start spending money soon.

People bring me their PC's to fix all the time, being the IT guy in the office. In general, what I do is Google the trojan, find some uninstall destructions and go through them. Usually gets rid of them. Run task manager and ID every process running. google them, kill the bad ones. I use Zone Alarm at home, but put the free AVG on other people's. The last one I fixed had about 40 virii on it and McAfee saying everything was just great. I wouldn't trust McAffee for anything.

Malwarebytes will clean it. as per my screenname, I'm an IT geek. I use that program on an almost daily basis to clean systems.

Dr. Hess wrote: People bring me their PC's to fix all the time, being the IT guy in the office. In general, what I do is Google the trojan, find some uninstall destructions and go through them. Usually gets rid of them. Run task manager and ID every process running. google them, kill the bad ones. I use Zone Alarm at home, but put the free AVG on other people's. The last one I fixed had about 40 virii on it and McAfee saying everything was just great. I wouldn't trust McAffee for anything.

The problem is that I don't know how to recognize the good from the bad. A further example of my incompetence is the fact that I am unable to find the task manager in the first place.

I'm tempted to throw it in the trunk of my car and drive it to Arkansas.

I will not be renewing my subscription to McAfee.

Grtechguy wrote: Malwarebytes will clean it. as per my screenname, I'm an IT geek. I use that program on an almost daily basis to clean systems.

I just sent you a PM. McAfee is seeing Wawarebytes as a trojan. Is it safe to disable McAfee while I download Malwarebytes?

control + alt + delete will bring up the task manager. From there you can click on applications tab to see which apps are running, or the processes tab to see the actual processes running, of which there are a LOT.

Woody wrote:

Grtechguy wrote: Malwarebytes will clean it. as per my screenname, I'm an IT geek. I use that program on an almost daily basis to clean systems.

I just sent you a PM. McAfee is seeing Wawarebytes as a trojan. Is it safe to disable McAfee while I download Malwarebytes?

Yes, generally you will have to temporarily disable any anti-virus software to install programs. It's OK.

If I didn't have so many photos of the new baby on this computer, I would be fixing it with a Mig Welder and an angle grinder.

I can do remote support if you want.....

Pics are pretty easy to save to another medium like CDs or DVDs or external drives.

How long have you had the computer?

Grtechguy wrote: I can do remote support if you want.....

That's a really cool offer. You rock!