Tech Support Forum banner

A TROJAN everytime?

1249 Views 7 Replies 7 Participants Last post by  Blitze105
Everytime my PC is restarted, a McAfee window pops up saying "The file C:\WINDOWS\System32\BECDFAFE.exe was infected by the Exploit-DcomRpc.gen trojan and has been deleted to complete the Clean process." If the trojan is removed then how can it reappear the next time my computer is restarted? Any ideas? Thanks.
Status
Not open for further replies.
1 - 8 of 8 Posts
PCPatrick said:
Everytime my PC is restarted, a McAfee window pops up saying "The file C:\WINDOWS\System32\BECDFAFE.exe was infected by the Exploit-DcomRpc.gen trojan and has been deleted to complete the Clean process." If the trojan is removed then how can it reappear the next time my computer is restarted? Any ideas? Thanks.
:cool:
There is a few ways of dealing with virus or spyware. actually the trojan keeps coming back everytime u restart is 2 possibility, 1 = the main file of the trojan is not the file that u have deleted by antivirus,as it auto generate everytime u restart. 2 = one of the trojan file or spyware is actually located in your startup, that is, in your "msconfig". (Start-->Run-->Msconfig-->StartupTab)

1st thing .. for safe precaution move... try unplug any connection to network or internet access.
2nd thing .. try scan again using your antivirus software and antispyware(make sure u have the latest patterns for both antivirus+antispyware)
3rd thing .. after scanning...i am sure u would find few either spyware or virus(so call).. fix it .. and the quarantine part, clear it all..
4th thing.. if the antivirus or spyware said fail to delete.. the next part u need to do is (abit troublesome but worth doing it.) as below...

1. Write down the name of the file,directory
2. Boot your windows to safe mode.
3. From safe mode.. go to cmd prompt <--(Start-->RUN-->cmd-->OK)
4. Try find the directory of the virus/spyware, delete it in the dos prompt, as most of the virus/spyware cant activate in the safemode.
5. After deleting all, don't reboot 1st, final step to double confirm..
6. Goto Start-->Run-->Msconfig-->Startup Tab
7. Now look for the similar filename at the startup or look for those are unnessary for window to load at startup. untick those unnessary.

Mission accomplished.
Good Luck to u.
See less See more
hi pcpatrick,

you can also download hijackthis from www.majorgeeks.com and post a hijackthis log of your computer in the hijackthis section.

another thing i recommend trying another good anti-virus program such as AVG. AVG always works out for me and it gets rid of the trojans that ive got in the past.

if you do decide to download AVG, which can also be downloaded from majorgeeks.com then i recommend uninstalling mcafee. two anti-virus programs take up system resources. when youve got AVG installed then i recommend you update it and then scan your computer for the trojan. see if AVG gets rid of it.
If you don't want to go through the hassle of uninstalling Mcafee, then run an online scan at www.antivirus.com ... Always a good second opinion.
Also you could do an online scan at Trendmicro or Panda.


Edit: oops...as above @ Chevy. :grin:
davcheong said:
:cool:

7. Now look for the similar filename at the startup or look for those are unnessary for window to load at startup. untick those unnessary.
Exactly the same file name. Or you take a risk of harming the O/S.

Do online scans u can find some in this link.
-blitze


http://www.tech-forums.net/showthread.php?threadid=53623&highlight=simple
I believe it's also recommended to disable system restore when deleting virus/trojan files --as they can be copied in the restore file, too. Hopefully there's no "next time" to try this, but you never know.
You can't just delete it you have to turn it off and it deletes. Good suggestion, though!

Here's how:
Start -> my computer -> view system info (top left) -> restore points -> and remove them all. (checkmark the box)
-blitze
1 - 8 of 8 Posts
Status
Not open for further replies.
Top