Trojan removal 'incognito'

[Paul Drawmer]

My son is in Turkey and he's picked up a nasty virus....

AVG is identifying 'incognito' but can't remove it.

Malware bytes has been rendered inop, and so is Windows Security Center.

He's pretty PC savvy, and he's done some searches but all we can both find are notes about posting Hijackthis logs.

Anyone know what incognito does, and is there a way of identifying where it is in his m/c.

I'm guessing it's be a registry job somewhere along the line.

[ErnestM]

Do a system restore to a point prior to the infection, then run malwarebytes and AVG to find it.

edit
If he has let it go too long, this method may not work

Edited by ErnestM on Saturday 27th March 13:07

[lestag]

Try trend housecall http://housecall.trendmicro.com/uk/
MS MSRT http://www.microsoft.com/security/malwareremove/de...

[Paul Drawmer]

Thanks I'll give them a try.

It's been very quiet from Turkey...but he probably doesn't want to go online.

[Muntu]

Boot into safe mode with networking, remame the malwarebytes exe (mbam.exe) to something else, update the signatures, then run it.

[bigdods]

Muntu said:

Boot into safe mode with networking, remame the malwarebytes exe (mbam.exe) to something else, update the signatures, then run it.

This worked for me when I had the antivirus virus. In fact I didnt need to boot to safe mode, just booted as normal, renamed mbam.exe to mbam.com then ran it, updated it, did a full scan job done.

[Paul Drawmer]

Thanks for the rename tip - I'll talk to him later this evn.

[Paul Drawmer]

ErnestM said:

Do a system restore to a point prior to the infection, then run malwarebytes and AVG to find it.

edit
If he has let it go too long, this method may not work

Edited by ErnestM on Saturday 27th March 13:07

Yep, he'd left it too long...

Muntu said:

Boot into safe mode with networking, remame the malwarebytes exe (mbam.exe) to something else, update the signatures, then run it.

This (fred.exe) appears to have done it. Thank you very much for the tip.

I've asked him to do a full scan with MSE to check.
Any other tips for checking - he's now feeling rather paranoid!

[Muntu]

Nice one

Get him to run it through the ESET/NOD32 online scanner, then all should be good!

http://www.eset.com/online-scanner