Windows Forum

Ask something
Discussion Locked

Trojan Win32.Swizzor.dh Found!

0 helpful
11 replies

by virgoan

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I just managed to remove some threats after being informed by my server firewall that the subjected trojan virus was found. I was using MS anti-spyware beta1 to troubleshoot my user pc. Not bad. Found some threats and removed. But then how come the next day these threats are found back again??? Please help...I have disabled his system restore before remove that threat. Symantec Antivirus is unable to detect this trojan :(

11 replies

by dmiles

The trojan is a downloader program that pretends to be one thing but otherwise something else,More than likely you have missed some of the associated files to the trojan that needs to be removed.

Check the Symantec or McAfee web sites for removal tools that would apply to servers

by dmiles

The trojan is a downloader program that pretends to be one thing but otherwise something else,More than likely you have missed some of the associated files to the trojan that needs to be removed.

Check the Symantec or McAfee web sites for removal tools that would apply to servers

Detection and Removal
Manual Removal
Follow these steps to remove TrojanDownloader.Win32.Swizzor.bh from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

Stop Running Processes:

Kill these running processes with Task Manager:

programfilesdir+\browsechicregs\refheckmore.exe

Remove Autorun Reference:

Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\driveadmin, delete it and reboot the machine immediately.

Clean Registry:

Remove these registry items (if present) with RegEdit:

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\driveadmin

Remove Files:

Remove these files (if present) with Windows Explorer:

programfilesdir+\browsechicregs\refheckmore.exe

by schema

You are lucky - This one should be pretty easy to remove, but it will slow down your server and require a couple of reboots to complete.

Just to keep it simple, download the latest version of Adaware from lavasoft.de and the latest version of Spybot S&D.

Install update and run Adaware first, then remove what it finds. Then do the same with Spybot S&D (they can catch different things).

I have high hopes for MS's AntiSpyware but it is NOT ready for real world use yet...

Good luck!

by virgoan

you are right! ms products are used to be very commercialize. anyway, can assist me on this? i found those infected files via online symantec antivirus scanning but was unable to remove one of the infected folder e.g. "c:\documents and settings\all users\application data\cake title cool multi\amen trans.bk! is infected with adware.lop". error message is " unable to delete the file it could be used by someone or program...". i have disabled some programs and even network connection but it just didn't work. it's contained a number of infected files. one of it was exe file.

by dmiles

First you have to disconnect the machine form the network,disable system restore,now see if the instructions from the second answer will work

by virgoan

thanks for your answer. due to swapping of some department pc so i managed to clean that by reformatting the whole disc :(

by virgoan

thanks for your answer. due to swapping of some department pc so i managed to clean that by reformatting the whole disc :(

This discussion is closed to new replies.