Solved Trojan found on new PC

TairikuOkami · Feb 4, 2023

RedLad said:
I've decided that I am going to just do a wipe, it will give me more peace of mind.

Still, you need to upgrade your security or you WILL get infected again. Free/Paid:

GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

Prevent Malware & Ransomware Infections on Windows PC | OSArmor

OSArmor is a Windows application that focuses on preventing malware and ransomware infections by blocking malware delivery methods and suspicious processes behaviors.

www.osarmor.com

badrobot · Feb 4, 2023

TairikuOkami said:
Still, you need to upgrade your security or you WILL get infected again. Free/Paid:

GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

Prevent Malware & Ransomware Infections on Windows PC | OSArmor

OSArmor is a Windows application that focuses on preventing malware and ransomware infections by blocking malware delivery methods and suspicious processes behaviors.

www.osarmor.com

Not necessarily unless the OP is very adventurous online. :)
I never had to do that.
What the OP needs is a back up plan.

TairikuOkami · Feb 4, 2023

badrobot said:
What the OP needs is a back up plan.

That is always a good strategy, but OP's Defender had detected the trojan after the PC was already infected (active).
AV should prevent the infection, not to stop it afterwards. It has managed to do it in time, but it might not the next time.

Hazel123 · Feb 4, 2023

It's free - most of the offline rescue disks are. One of the few bonuses in life. They probably hope you will sign up to one of their other products if you're happy or something.

It's all on the page linked below. It's for Windows 11 as well - even though they haven't updated their web page to add Windows 11 (checked that elsewhere).

You just need a usb stick and to know how to boot from it. So you either need to know which function key takes you to the boot menu, or with some computers you just press escape repeatedly when turning on and a menu gives you options and you choose the Boot menu.

What computer is it?

So you download the Rescue disk antivirus software. Perhaps on a different computer if you have one around. Insert the usb stick and follow the instructions for getting the program onto the usb stick.

Then insert the usb stick into the computer you want to scan, while it's turned off. When you turn it on, hit the correct function key to go to the boot menu. The boot menu will give you the option to choose your hard drive or the usb stick. Use up down arrow keys to select the usb stick and hit return and it starts to boot the rescue disk.

There is no graphical interface (ie pictures) with this one - just text. So you use the arrow keys and return key on the keyboard to select things.

Easier than it sounds.

Trend Micro Rescue Disk Discontinued

Trend Micro Rescue Disk is discontinued as of April 25, 2025. Discover alternative solutions to ensure your devices remain protected against threats.

www.trendmicro.com

Hazel123 · Feb 4, 2023

It's the same principle as booting Windows from a usb stick when you go to install it.

The rescue disk/usb bypasses windows altogether so it can check a dormant hard drive. It doesn't install anything - it's all on the usb stick.

After downloading the rescue disk software, you run the installer and it'll ask you which drive to install it onto - make sure you select the drive number for the usb drive!

Hazel123 · Feb 4, 2023

TairikuOkami said:
That is always a good strategy, but OP's Defender had detected the trojan after the PC was already infected (active).
AV should prevent the infection, not to stop it afterwards. It has managed to do it in time, but it might not the next time.

Windows Defender is supposed to be pretty good these days. If the OP uses it with Malwarebytes free it could be ok. Depending on what kind of websites you go to etc. I use a paid for AV - because I think it's worth it for about £25 a year for 5 licences (you can shop around for the best price/deal) plus Malwarebytes free.

Having said that about Defender, I just read this

"The catch with Windows Defender and the other built-in security tools and features in Windows is that you have to stick to Microsoft products. This means using Edge instead of Chrome or Firefox as your default browser, Microsoft Office 365 instead of Google Workspace or LibreOffice and Microsoft Teams instead of Slack or Zoom.

As a result, if your Chrome or Firefox browser is used to visit a malicious website, you’ll have to rely on the browser’s own protection, not Microsoft’s. To be fair though, the protection offered by Chrome and Firefox is pretty good on its own."

Is Windows Defender good enough for my new laptop?

Microsoft’s Windows Defender antivirus software now comes with Windows but is it good enough?

www.tomsguide.com

jimbo45 · Feb 5, 2023

flashh4 said:
I disagree with a lot of you who have never done any cleaning other than to spend the time to wipe your hard drive & some Trojans will stay ! Go ask any Malware Removal Specialist if you do not believe me ! Sometimes we have had to run 3 or 4 different programs to find & remove them ! As you said WAI "they just don't go away" !
Most will be removed with a wipe but not all !

This sort of argument sounds like if you are a Pilot -- would you take a knowingly defective plane into the air and then repair it or do it while its on the ground.

I know -- (and I have held a PPL for years) that if there's any inclination of a problem then that plane stays on the ground until its repaired.

So while I would always prefer to do a totally clean install to repair an infected computer - you could use a remote machine to cleanse the infected one if you really don't want to do a clean install.

Before doing the clean install - I'd cleanse the HDD/SSD too by writing x'00' or random binary characters on every single physical sector which will totally remove any lingering code that might be stubbornly hidden on the disk. Don't forget the cache as well -- plenty of programs around to do this including various "Low Level" formatting applications.

Cheers
jimbo

Haydon · Feb 5, 2023

By now, any sane OP

will have become insane

RedLad · Feb 5, 2023

TairikuOkami said:
Still, you need to upgrade your security or you WILL get infected again. Free/Paid:

GitHub - AndyFul/Hard_Configurator: GUI to Manage Software Restriction Policies and harden Windows Home OS

GUI to Manage Software Restriction Policies and harden Windows Home OS - AndyFul/Hard_Configurator

github.com

Prevent Malware & Ransomware Infections on Windows PC | OSArmor

OSArmor is a Windows application that focuses on preventing malware and ransomware infections by blocking malware delivery methods and suspicious processes behaviors.

www.osarmor.com

I have to say I disagree with that statement. I have always used the Windows security with Malwarebytes for years and have been fine. This was just an unfortunate incident! If you think about it, so many of them companies have been spamming their anti-virus software for so long, for years. In magazines, etc. Lots of ways of almost forcing their software on you. But now, it seems many of them are not even needed. I'd say many of them have taken a huge hit if you compare now to many years back when they were almost looked upon as a necessity. That is my opinion anyway and is probably more geared toward home users. I'd say it's a different story for big companies.

RedLad · Feb 5, 2023

Hazel123 said:
It's free - most of the offline rescue disks are. One of the few bonuses in life. They probably hope you will sign up to one of their other products if you're happy or something.

It's all on the page linked below. It's for Windows 11 as well - even though they haven't updated their web page to add Windows 11 (checked that elsewhere).

You just need a usb stick and to know how to boot from it. So you either need to know which function key takes you to the boot menu, or with some computers you just press escape repeatedly when turning on and a menu gives you options and you choose the Boot menu.

What computer is it?

So you download the Rescue disk antivirus software. Perhaps on a different computer if you have one around. Insert the usb stick and follow the instructions for getting the program onto the usb stick.

Then insert the usb stick into the computer you want to scan, while it's turned off. When you turn it on, hit the correct function key to go to the boot menu. The boot menu will give you the option to choose your hard drive or the usb stick. Use up down arrow keys to select the usb stick and hit return and it starts to boot the rescue disk.

There is no graphical interface (ie pictures) with this one - just text. So you use the arrow keys and return key on the keyboard to select things.

Easier than it sounds.

Trend Micro Rescue Disk Discontinued

Trend Micro Rescue Disk is discontinued as of April 25, 2025. Discover alternative solutions to ensure your devices remain protected against threats.

www.trendmicro.com

Thanks a lot. I have a new USB stick here ready to use for it. It is a custom built PC, not a specific make. I will check to see about getting into the BIOS to change the boot mode.

Why do you say use a different computer, just in case this is infected? I have my older PC that has Windows 10, but that in't even hooked up to my screens and even if I plug it all back in, the data hard drives it was using for downloads is now in this new PC I have. Well, the downloads were pointing to the sata drive it that makes sense. Prob more a pain to get that plugged back in etc.

RedLad · Feb 5, 2023

Haydon said:
By now, any sane OP will have become insane

RedLad · Feb 5, 2023

Hi @Hazel123 I downloaded the software, installed it to my USB stick. Restarted. Tried to boot to the USB, it recognised it. But I keep getting a screen with the folowing message and it won't do anything, I keep having to power off and keep seeing the same screen.

Only 64-bit images supported
_

Any ideas? Of course this wouldn't work as it should for me, I knew it haha

RedLad · Feb 5, 2023

A side story...I just hopped over to Kaspersky

And out of the blue, a file downloaded automatically called KVRT.exe

The page was Free Virus Removal Tool | Free Virus Scanner and Cleaner | Kaspersky

I deleted this straight away, this is crazy that it just downloaded that without me wanting to.

Haydon · Feb 5, 2023

Perhaps the Kaspersky tool auto-downloads, because there is malware out there that prevents the download of anti-malware apps.

It looks like you don't need the computer right away, so that you can try out 70+ posts worth of suggestions, and it would be a good learning experience too, but IMNSHO re-read my post #8.

RedLad · Feb 5, 2023

Haydon said:
Perhaps the Kaspersky tool auto-downloads, because there is malware out there that prevents the download of anti-malware apps.

It looks like you don't need the computer right away, so that you can try out 70+ posts worth of suggestions, and it would be a good learning experience too, but IMNSHO re-read my post #8.

Ok, good to know it may auto-download due to that.

Yes, there are lots of posts in this thread. What exactly are you referring to in your #8 post?

Right now, my main thing is getting this Trend Micro running from the USB I have put it on. I don't know why that would decide not to work. My PC is hardly setup in a way that doesn't allow this? It is an expensive enough machine I bought. Anyone with any ideas why this isn't wotking, feel free to chime in here, thanks.

Haydon · Feb 5, 2023

My post #8 foresees the 70+ posts

I can't help with the Trend Micro tool, I don't remember ever having used it, others will have to chime in.

There are quite a few other similar tools, though, and ironically, the Kaspersky tool is one of them. I did use the Kaspersky tool, more than a couple of times even, as a second opinion scanner, but it was many, many moons ago, and maybe the tool itself has evolved, nonetheless the Kaspersky tool still has a good reputation.

You may want to read this thread that I recently started Do you use portable anti-malware apps?

RedLad · Feb 5, 2023

Haydon said:
My post #8 foresees the 70+ posts

I can't help with the Trend Micro tool, I don't remember ever having used it, others will have to chime in.

There are quite a few other similar tools, though, and ironically, the Kaspersky tool is one of them. I did use the Kaspersky tool, more than a couple of times even, as a second opinion scanner, but it was many, many moons ago, and maybe the tool itself has evolved, nonetheless the Kaspersky tool still has a good reputation.

You may want to read this thread that I recently started Do you use portable anti-malware apps?

Is there some sort of dark art at play? I am not sure what you mean haydon? Or are you saying in a weird way that people have been wasting their and my time here? Not too sure what you're getting at here.

Anyway yeah Kaspersky. Someone commented that is was linked to the Russia, not sure if you have read that? It would be complete thrash talk, or it could be a very good point, I am not sure. But here I am with half the day gone and I am not closer to getting the PC wiped because of the holdup with Trend Micro not wanting to boot from the USB. Ya gotta love good oul technology, eh?

LesFerch · Feb 5, 2023

After four pages of discussions, it appears that no one has mentioned false positives. While I'm not advocating lowering your guard and assuming an alert is a false positive, it's an important possibility to keep in mind, especially if you're considering spending a lot of time rebuilding a system.

Sometimes all it takes is to check what has been quarantined and do a search online to determine what the file is and where it came from. Often that will reveal information about whether it's prone to cause false positives. For example. Nirsoft utilities often trigger false positives, as do many others, such as Cmdow, and my own WinSetView. Also, perfectly legit Cmd, VBS, and PowerShell scripts can trigger false positives, even ones you've written yourself.

The first question is always "where did this come from"? If it was in the Downloads folder (before being quarantined), look at when it was downloaded and what other files were downloaded at the same time. Is it your download or somebody else's (i.e. on a shared PC). Some basic investigation should start to give you a sense of whether it's likely to be a threat or not.

Haydon · Feb 5, 2023

RedLad said:
Is there some sort of dark art at play? I am not sure what you mean haydon? Or are you saying in a weird way that people have been wasting their and my time here? Not too sure what you're getting at here.

Anyway yeah Kaspersky. Someone commented that is was linked to the Russia, not sure if you have read that? It would be complete thrash talk, or it could be a very good point, I am not sure. But here I am with half the day gone and I am not closer to getting the PC wiped because of the holdup with Trend Micro not wanting to boot from the USB. Ya gotta love good oul technology, eh?

No dark art, just that some people are habitually riding out their egos, and yes, that can lead to wasted time

Yes, I read the comments about Kaspersky and other conspiracy theories

You don't a priori pick a tool that does not work

You pick a tool that does work

Haydon · Feb 5, 2023

LesFerch said:
After four pages of discussions, it appears that no one has mentioned false positives. While I'm not advocating lowering your guard and assuming an alert is a false positive, it's an important possibility to keep in mind, especially if you're considering spending a lot of time rebuilding a system.

Sometimes all it takes is to check what has been quarantined and do a search online to determine what the file is and where it came from. Often that will reveal information about whether it's prone to cause false positives. For example. Nirsoft utilities often trigger false positives, as do many others, such as Cmdow, and my own WinSetView. Also, perfectly legit Cmd, VBS, and PowerShell scripts can trigger false positives, even ones you've written yourself.

The first question is always "where did this come from"? If it was in the Downloads folder (before being quarantined), look at when it was downloaded and what other files were downloaded at the same time. Is it your download or somebody else's (i.e. on a shared PC). Some basic investigation should start to give you a sense of whether it's likely to be a threat or not.

Yeah, have multiple tools in your toolbox

Solved Trojan found on new PC

Microsoft 365 Basic

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Microsoft 365 Basic

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computers

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer