Trojan.Startup.Nameshifter.G

  • Thread starter Thread starter Brock
  • Start date Start date
B

Brock

I saw the question about this signature and I was wondering
will I have to remove these myself or can I let it finish
on its own. Its been running for several hours and its up
to 321000 signatures.
 
I'd quit.

Either try safe mode, or try a different cleaner--maybe an online antivirus
scanner.
 
I tired Norton Anti-Virus 2005 and yet it doesn't even detect it!

Also, now instead of the Trojan its starting to have this other worm!
Worm:Win32/Gaobot.dr!!!


What do I do?? IT keeps coming back and I went to safe mode so many times
trying to do so many scans and yet nothing has worked!!! Why WHY WHY!!!
='"(!!!

Norton Anti Virus keeps popping up saying that Trojan is trying to come back
in even when I disconnected the internet!!

HELP ME!!
 
Sorry I made a mistake, it wasn't Trojan.Startup.Nameshifter.G, but it was
Trojan.Startup.Nameshifter.CQ!!!!

They are the nearly the same right?


HELP!
 
Gerald - I'd call Microsoft PSS on this one. You've got something that is
recognized but not cleaned by either your antivirus or Microsoft
Antispyware. You could try plun's excellent advice, but you might benefit
more by direct phone advice from somebody who should stick with you until
the problem is solved.

In the United States or Canada, call 1-866-pcsafety for free help from
Microsoft with virus related or security patch related problems. Elsewhere,
call your local Microsoft subsidiary or the number for paid support in you
area and ask for the free help wth virus or security patch related issues.

--
 
Hi Plun, Thanks for the reply!

The problem is that Norton Anti-Virus 2005 always has these warning pop ups
saying that it a Trojan Horse "hclean32.exe" was detected by the "Auto
Protect Feature", what's strange is that it keeps attacking when either the
internet has been disconnected and when I kill it with Microsoft anti
spyware. I have the following programs right now installed: MSAS, Pestpatrol
4, Norton Internet Securities 2004, Norton Anti Virus 2005, CCleaner, and
just recently a CounterSpy trial version. I ran scans with ALL the programs
and here were the results:

Norton AntiVirus detected: NO VIRUSES
Pest Patrol detects this Unknown Trojan Once a while but stop recently
CounterSpy only found some Cookie which wasn't related to the event
CCleaner didn't really find anything but garbage which weren't related
Microsoft Anti Spyware Detects the "HCLEAN32.EXE" Trojan even though when I
look @ C:\Windows\System32 its not there! But Microsoft Anti Spyware detects
it and saids it there even though I cant see it, and No it wasn't a Hidden
File or whatsoever.

After with Microsoft Anti Spyware deleting the file, Norton Anti Virus pops
up a warning that the "HCLEAN32.EXE" is trying to come in again and the
"Auto Protect feature" stopped it but once again Microsoft Anti Spyware
finds it and deletes it. But now, instead of the Trojan loop, it now finds
the Worm:"Win32/Gaobot.dr" instead of the Trojan!!, What's funny about this
time is that I cant seem to actually find it based on where it said its
location was!

Everyday ever since these 2 days I have been running scans till 4AM in the
morning and keep finding the same thing over and over after deleting but
just recently as I am writing this message, MSAS just finished scanning
didn't detect the Worm or Trojan. But my computer is a bit slower now and it
takes a while just to log in and load the computer when I turn it on.

How I got this virus was really funny, recently I was browsing my normal
internet site and one of the Ads popped up after going through the Windows
Pop up blocker and MSN pop up blocker and going through Norton Internet
Security Pop Up Blocker! I tried to close the window but instead it froze
and then I tried End Task but it was still there and then I closed it by
Task Manager through Processes, then Norton Started popping up with these
Virus Alert "HCLEAN32.EXE".

Right now everytime I turn on my computer I always keep running Scans after
Scans. In my computer experience I have never seen a virus like this before.
I have removed so many viruses for my friends computers but never before I
have seen anything like this..... Never....

I look in the Processes and I don't see any of the "HCLEAN32.EXE" running or
"DMXIF.EXE" running.

But what's weird is that I haven't seen this one running before:
"sunasDtServ.exe" or "gcasDtServ.exe" or "gcasServ.exe", I looked @ the
internet and it said it was either a Worm or Trojan or MSAS......

I think I might want to hold on Calling Microsoft, Bill and try all options
here before calling. I'm pretty confident that we can work something out
here.

Sorry if I took a lot of your time guys but I hope this helps.

-Gerald
 
Gerald Mak said:
But what's weird is that I haven't seen this one running before:
"sunasDtServ.exe" or "gcasDtServ.exe" or "gcasServ.exe", I looked @ the
internet and it said it was either a Worm or Trojan or MSAS......

I think I might want to hold on Calling Microsoft, Bill and try all
options
here before calling. I'm pretty confident that we can work something out
here.

The two starting with gc are legitimate processes related to Microsoft
Antispyware.

This thing seems to be hiding pretty well--have you been doing this
detection and cleaning work in safe mode?

You could also try these rootkit apps:

http://www.f-secure.com/blacklight/

http://www.sysinternals.com/utilities/rootkitrevealer.html

I don't have any doubt that, although you are having trouble seeing the
executables involved, you are infected.
 
Just recently, very recently I have stop receiving the Norton Anti Virus pop
ups regarding about the virus.
Also MSAS just stop detecting the Worm nor the Trojan, and the "blacklight"
didnt find any hidden items!

I also ran a scan with all those programs I listen just a while, and it
seems that they didnt find anything!

What still puzzles me is my computer at this slow speed on the internet, I
think it might
have been done by the damage maybe. Any advice?

Thanks for all your support guys!
 
Sounds like good news, except for the slow speed.

I can never tell objectively what people mean by that term--is this
something you'd see if you went to a speed measurement site? Is there
outbound traffic from your machine that seems out of the ordinary?



--
 
Yes the speed for measurement site, that virus had also added some "porn"
links in the Favourites that I just noticed.


I couldn't believe that I had to use 7 programs just to get rid of that
thing hahaa....
 
Back
Top