Malware Discussions

[baldy64]

About 5-6 times a day I get the message from Trend Micro stating I have to reboot as threats were found.  It is always TROJ_SPNR.15A912.  Why does this keep coming up and why is it not able to be permanently removed by Trend Micro?  I have Trend Micro Titaniium Maximum Security.  This happens even if I am logged off and not on the internet.

Also, ever since I installed Trend Micro my computer is slow as molasses on the internet.  I have uninstalled and reinstalled and it has made no difference.  All of my previous virus programs have been removed.  I also have a lot of internet pages load as a blank white page and I have to refresh to get the page I requested.

Please help!  Thank you

[simonn]

Hi baldy64,

Please run a full system scan using your Trend Micro program then export the log report and attach it here so we can check what file is being detected as such.

Regards,

Simon

[simonn]

Hi baldy64,

Thank you for posting the log file. As I checked on it the trojan that trend keeps on detecting is located in the system volume information folder of your computer that is part of the System restore. We need to turn off system restore so trend can clean the infection. You may refer to this link how to disable System Restore. After disabling it, run again another scan and it should be able to take care of that trojan file. Afterwards, you may re-enable the system restore.

Hope this helps.

Regards,

Simon

[malwarekiller]

Welcome aboard! 

Yes,thats in the system restore...run a small scanner to ensure its gone.

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

[baldy64]

Simonn,

I did what you mentioned, ran the scan again, etc. and rebooted the computer this morning.  I then turned it off for the day.  When I turned it back on this evening, after about 50 minutes of being on, it still comes up and tells me to reboot.  Here is the export log from just that threat that showed up when it told me it found it and told me to reboot again:

[malwarekiller]

Just use Malwarebytes as instructed and it wil be fixed...

[simonn]

Baldy64,

Did you turn off the system restore before running a scan with trend?

[baldy64]

Simonn,

Yes, I turned off system restore.  I did all of that, and ran malware bytes (I bought a disk copy last week).  It removed one piece of malware when I did a flash scan (trace.malware).  However, I kept having problems with the TROJ_SPNR constantly reappearing as well as having web pages getting redirected, and I would run malware bytes full scan again and again as well as my virus scan with the restore turned off, etc. and it kept reappearing. 

So we put the acronis image I had saved back on my computer from several months ago, and we will see if everything works like it should now.

I appreciate all of your help

[malwarekiller]

 I would need some logs to analyze your problems..

• Download RogueKiller and save it on your desktop.  
•     Quit all programs 
•     Start RogueKiller.exe.  
•     Wait until Prescan has finished ... 
•     Click on Scan

  
   

• Wait for the end of the scan.   
•     The report has been created on the desktop.   
•     Click on the Delete button.

  
   

• The report has been created on the desktop.

• Next click on the ShortcutsFix  
    
    
• The report has been created on the desktop.

Please post:  
  
All RKreport logs located on your desktop.

NEXT

Download OTL  to your Desktop.

http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe

netbt.sys

atapi.sys

volsnap.sys

redbook.sys

lsi_sas.sys

lsi_scsi.sys

cdrom*

tcpip.sys
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U\*.* /s

C:\Program Files\Common Files\ComObjects\*.* /s
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • attach both logs

 NEXT

Download aswmbr.exe ( 1.8mb ) to your desktop. 

http://public.avast.com/~gmerek/aswMBR.htm
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan.

• 

• Click the [Scan] button to start scan

  

• On completion of the scan click [Save log], save it to your desktop and post in your next reply.