I think I have a Trojan.. help.

Hi there

I'm having problems, with what I believe is a trojan.

I used to have Avast, and I guess I never registered it, so it expired and no longer monitored my pc, well I thought I had McAfee, (which is on the bottom right corner of my pc) but obviously it's NOT updated.

I removed avast and re-installed, and now I'm good to go and also registered, but I ran a complete scan, and gives me the following message:

C:\WINDOWS\SYSTEM32\ddccy.dll is infected by win32:ConHook-C [Trj]

I've been having annoying IE pop-ups, with winfixer, "your computer is infected, DL this ", sex-buddies.com, and weird stuff like that!

Can I get some advice/direction on how to remove the above trojan safely without any further problems? Do I need to hire professional help?

PS, this site was recommeded by a friend on another message board, she highly recommended your forum!

Thanks in advance!!!

 

Hmm....

Unfortunately, I do not have time to completely troubleshoot this at the moment. Let me suggest this . . .

Post the same message over at this forum:

http://www.dslreports.com/forum/security

you should get help instantly.

Goodluck.

 

Welcome to WindowsBBS LeslieA

Lets start with an online virus scan. Go to Panda ActiveScan and scan your computer. When the scan is complete, save the report and post it back here.

Download HijackThis.exe from here. Save it to a permanent folder (I create a new folder in C:\ named HJT). Open and click scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet!

 

Remember, that while a virus "infects" other files, a trojan is the infected file.
So what you need to do is identify the process which this file runs
C:\WINDOWS\SYSTEM32\ddccy.dll
Hijackthis , or the startup manager in codestuff starter can reveal it.
Codestuf starter startup manager and process viewer


Then using task manager or the process tab in starter to kill that process and then you can remove the startup entry (either with hijackthis or starter) and delete the file itself
You should probably post a hijackthis log so that someone can review it and give you step by step instructions, as well as make sure you do not have something else which you have not identified.

Hijackthis
Download, unzip and extract to a permanent folder of your creation such as C:\ProgramFiles\Hijackthis\Hijackthis.exe
Run and choose scan and save logfile. Copy the contents of the notepad window which opens and post it here.