Trojan impossible to remove! Solved

Question

Hello everyone,  I have been infected for several days with various trojans. No matter what I try, I can't seem to remove them. My Windows Defender antivirus detects them but can't remove them. I have been denied access to the infected folders and files. I tried with Unlocker, command line, known antimalware, antivirus, in safe mode, and by using a Linux partition.  I am reaching out for your help to find a solution. My PC is running so slow  Here are the 3 files from the FIRST analysis https://pjjoint.malekal.com/files.php?id=20180221_l15l11d14z5b11 https://pjjoint.malekal.com/files.php?id=FRST_20180221_m10v11o15x9i9 https://pjjoint.malekal.com/files.php?id=20180221_r12e6o14p6u14  and the ZHPDiag analysis https://pjjoint.malekal.com/files.php?id=20180221_g7s13v11y13d10  thank you in advance

guiguilamisere · Accepted Answer

Hello, Trojans are very difficult to remove. Try to find the infected files and change their extensions (like (infected file name).DSJFG92 but not with system folders) You can also go to the task manager and send us a screenshot of all the running programs.

Malekal_morte- · Answer

Hi,  yep, Windows Defender detects it as Trojan:Win32/Detrahere.B!dr:  Date: 2018-02-20 13:57:34.556 Description: Windows Defender Antivirus has detected malware or potentially unwanted software. For more information, please refer to the following: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3aWin32%2fDetrahere.B!dr&threatid=2147725568&enterprise=0 Name: Trojan:Win32/Detrahere.B!dr ID: 2147725568 Severity: Severe Category: Trojan Path: file:_C:\Users\Ingrid\AppData\Local\wmhopvk\mbciaxz.exe Detection origin: Local computer Detection type: Concrete Detection source: Real-time protection User: NT AUTHORITY\SYSTEM Process name: C:\Windows\System32\ramhvzpsvc.exe Signature version: AV: 1.261.1369.0, AS: 1.261.1369.0, NIS: 118.2.0.0 Engine version: AM: 1.1.14500.5, NIS: 2.1.14202.0      Here's the fix to perform with FRST. You can refer to this explanatory note with screenshots. Restart FRST and then press CTRL + Y on your keyboard. The notepad will open, copy/paste this.  CreateRestorePoint:CloseProcesses: C:\WINDOWS\system32\drivers\zaiehlor.sys -> Access denied <======= WARNING  2018-02-20 15:00 - 2018-02-20 15:00 - 000000808 _____ C:\WinChk.txt  2018-02-20 14:59 - 2018-02-20 14:59 - 000468480 _____ () C:\Users\Ingrid\Downloads\CKScanner (3).exe  2018-02-20 14:58 - 2018-02-20 14:58 - 000468480 _____ () C:\Users\Ingrid\Downloads\CKScanner (2).exe  2018-02-20 14:58 - 2018-02-20 14:58 - 000468480 _____ () C:\Users\Ingrid\Downloads\CKScanner (1).exe  2018-02-20 14:56 - 2018-02-20 14:56 - 000315000 _____ C:\Users\Ingrid\Downloads\winchk_2.0.exe  2018-02-20 14:55 - 2018-02-20 14:55 - 000468480 _____ () C:\Users\Ingrid\Downloads\CKScanner.exe  2018-02-20 13:57 - 2018-02-20 15:46 - 000000000 ____D C:\Users\Ingrid\AppData\Local\remncwu  2018-02-20 13:57 - 2018-02-20 13:57 - 000000000 ____D C:\Users\Ingrid\AppData\Local\wmhopvk  2018-02-20 13:55 - 2018-02-20 13:55 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd  2018-02-20 06:30 - 2018-02-20 06:30 - 000142672 ____N C:\WINDOWS\system32\Drivers\zaiehlor.sys  2018-02-17 00:26 - 2018-02-17 19:21 - 000260389 _____ C:\Users\Ingrid\Desktop\ZHPDiag.html  2018-02-16 23:33 - 2018-02-16 23:33 - 000001304 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk  2018-02-16 23:33 - 2018-02-16 23:33 - 000001292 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk  2018-02-16 23:14 - 2018-02-16 23:14 - 003009408 _____ C:\Users\Ingrid\ZHPDiag3.exe  2016-09-05 22:52 - 2017-10-09 15:02 - 002950528 _____ () C:\Users\Ingrid\ZHPCleaner.exe  2018-02-16 23:14 - 2018-02-16 23:14 - 003009408 _____ () C:\Users\Ingrid\ZHPDiag3.exe  2014-04-01 13:46 - 2014-04-01 13:46 - 000495616 _____ (Simon Tatham) C:\Program Files (x86)\putty.exe  2018-02-11 18:30 - 2018-02-16 22:14 - 000000033 _____ () C:\Users\Ingrid\AppData\Roaming\AdobeWLCMCache.dat  2018-02-13 23:45 - 2018-02-16 22:31 - 000000028 _____ () C:\Users\Ingrid\AppData\Roaming\kulerdata.json  2016-09-01 18:57 - 2018-02-09 19:40 - 000000132 _____ () C:\Users\Ingrid\AppData\Roaming\Prefs PNG Format Adobe CS6  2014-05-20 10:36 - 2016-01-22 12:33 - 000000600 _____ () C:\Users\Ingrid\AppData\Roaming\PUTTY.RND  2014-03-27 11:29 - 2014-03-27 11:29 - 000000044 _____ () C:\Users\Ingrid\AppData\Roaming\WB.CFG  2016-08-31 09:12 - 2016-08-31 09:12 - 000127639 _____ () C:\Users\Ingrid\AppData\Local\89585681.exe  Hosts:EmptyTemp:RemoveProxy:Reboot:  Save the content from the file menu and then save.  Close the notepad, go back to FRST and click on the "Fix" button A restart may be necessary and automatic. A text file will appear, copy/paste the content here in a new message.  Restart the computer.  2°) Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware free version tutorial  3°) See how that goes and if there have been improvements. If not, if you still have pop-up ads, specify which web browser. Redo a FRST scan and provide the new reports via attachment.

Trojan impossible to remove!

2 réponses

End of Fixlog 21:11:22

Saracroche: the effective french app against phone spam

How to get the character µ on the android keyboard.

Texture issues in enshrouded

Access issue to my "contact me" profile

Windows spotlight is not working.

Black screen digital camera

Connecting rj45 cable with fiber

Sony bravia tv red led blinks 4 times

Free: associating with the freebox server in progress

Inuyasha in french