Trojan horse hider.MPR

[WorraLiberty]

Does anyone know how to remove this from a PC please?

I was browsing MN yesterday when it just popped up and now the computer is buggered.

Microsoft Security Essentials keeps finding it and splatting it, but it just comes right back and the whole cycle repeats itself.

It won't let me run AVG or any of my other scans...they either don't open or they just 'start scan' and then immediately say 'scan is finished'.

Then it has the brass neck to 'congratulate me' on it not finding any viruses

TIA

Can you download anything? If so, find Malwarebytes at download.com. See if you can install and run it.
Link -
download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol;1

If no success with this - try starting your PC in safe mode. You need to restart and press f8 repeatedly at bootup, until you see the black screen with options asking whether to start windows normally, in safe mode etc. Select safe mode with networking to start with.

The safe mode screen will look ugly, but never mind, just try running your AV scans again, including Malwarebytes. Do complete scans, not quick scans (might take a long while, so be ready for that).

If this doesn't work, post again, as it might need more specialist attention.

Thank you

I've got Malwarebytes but it won't let me run it or the AVG scan. It lets me run MSE (though it won't let me update it) it splats it, tells me to restart and then the whole process starts again. I even turned off system restore (briefly) and ran the scan but the same thing happened.

It's exactly the same in safe mode. I can't use Google Chrome either but IE is ok...just very slow. It won't let me download anything but I do have a USB stick and another computer.

If I was you,I would do a system restore to a date before this started,hopefully then you will be able to run malwarebytes scan.
Do you have Microsoft Security Essentials and AVG installed?If so this will cause a conflivt,you should only have one antivirus programme and a malware programme.

Argh, that one's in deep! Good ideas from sassy, any luck?

Another thing is to try downloading Malwarebytes to your USB stick, via the clean PC. Install it on the stick, then plug it into the infected machine and see if you can scan the infected PC from there. It might also be worth running Kaspersky's virus removal tool from the same location (if it works )...

www.kaspersky.com/virusscanner

Have a search through this forum too, in case there is any help for this particular Trojan.
forums.techguy.org/54-virus-other-malware-removal/

There are threads about it here forums.whatthetech.com/index.php?s=e90cc7445e099078325357d40841717c&showtopic=124776 and here forums.whatthetech.com/index.php?showtopic=122550&st=0

They're quite long but do come up with a solution so might worth a read. If they seem helpful you could post your own thread.

Also, if the trojan will let you run it you could try an online scan housecall.trendmicro.com/uk/index.html I got rid of a troublesome one using that when desktop software couldn't run.

A trojan in the Master Boot Record is quite difficult to get rid of.
Firstly remove Microsoft Security Essentials from your system.
Is AVG up to date? Run a full scan from it and report back.

Personally I would ditch AVG and keep Microsoft Security Essentials,AVG can conflict with Malwarebytes here.

I seem to recall that if you can't run some programs like MalwareBytes, it may be possible to fool the trojan by renaming it?

Thanks so much everyone

I've finally splatted it with SpyBot Search and Destroy witch was the only scanner that would work...all the others like AdAware, Malwarebytes, AVG etc just wouldn't run even when I took them from the clean PC.

But it's sorted now so pheww! And thanks again

Oh excellent, nice work WorraLiberty! And thank you for sharing the solution

Shame that while MNHQ can delete a posting, it cannot be reset to the state before (ie would be nice if a posting was deleted completely, lost from thread, and 'last updated' would return to 2012-11-20 so it would disappear off 'current threads' list within the topic.

Something for Tech to consider when they have time, eh?

Deleting the post seems easy, and 'unlinking' it from the thread should be, or I haven't been in IT for 30+ too many years :)