Trojan.Ducky.B

P

prusd

New Member
Hello,

My computer was hit with the Trojan.Ducky.B virus. Norton Anti-Virus partially quarantined it. I want to know how to completely remove it. I am running windows xp.


Thank you very much.
 
Download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.Please install it there.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.
 
Thanks edifier, but hijackthis wont install because of some missing .DLL file. That was fishy. Do you have any other ideas to check for the trojan.ducky.b virus?

Thanks again
 
Lets do some cleaning first then.

Download Ewido http://www.ewido.net/en/download/ then set it up this way http://rstones12.geekstogo.com/ewidosetup.htm You will need this later in safe mode
Make sure to update this program.

Next, download, install and update 'A-squared' here http://www.emsisoft.com/en/software/free/

Download, install and update this excellent freebie- Superantispyware here http://www.superantispyware.com/download.html

Download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ You will need it later in safe mode.

Now, reboot your computer in Safe Mode by doing the following.

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Proceed to the Norton Quarintine folder and delete it's contents.Then 'Disable' Norton.

Begin running your scans in this order.

Ewido ('Scan/Settings'- all boxes are checked under 'Possibly unwanted software' )
A-squared
Superantispyware

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot into normal windows, run ATF cleaner again, empty the Norton 'Recycle Bin' and run this free online scan from 'Panda' http://www.pandasoftware.com/products/activescan.htm Save the log and if any infections remain, post it here along with a new HJT log.
 
Yikes edifier. I don't think I am computer savvy to do all that. I will try taking in my computer to a store and have them check for infections.


Thanks anyway.
 
its a program that will allow you to delete a file before your computer starts up. very handy tool for those programs that load on startup like your ducky virus maybe.
 
You must log in or register to reply here.
Back
Top