Need help urgently!

[mercurial]

I installed a program but as soon as I did, ESET flagged it and removed it. Problem is that it hasn't removed it. I checked my temp folder and saw that it has stored my ADSL dialup account details and I noticed that "firefox" is open under task manager but as soon as I try to close it, it just reopens again. I urgently need to remove this

 

[LazyLion]

first of all, go to your firewall and reset all defaults. Only allow a different browser, not firefox.

 

[LazyLion]

can you google for the name of the program and see if there is a removal tool.

or send it to me so I can help you google for it?

 

[LazyLion]

do you have a bandwidth monitor? Like Netlimiter?

can you tell if any programs are communicating?

Do you have a different computer you can use temporarily so you can cut net access to the infected computer?

 

[LazyLion]

you also need to e-mail you ISP and request a password change as soon as possible, just in case.

 

[LazyLion]

Do you know what the name of the infection was? Did Eset tell you what it was trying to remove? Can you go back and look at the logs?

 

[mercurial]

Thanks Gary

I could request a password change but this program will just get the new ones that I changed and try to send it out anyway. I checked my Comodo connections but I can't see that it's sending anything out, but I do still see that firefox runs in the background. I'm installing Spybot as well as some other apps now to see if it will help.

 

[LazyLion]

what OS are you using?

can you download a kill process program like this?

http://www.softpedia.com/get/System/OS-Enhancements/Kill-Process.shtml

 

[mercurial]

XP with SP3. Will try that now.

 

[bradrap]

Couldn't think of those questions at the same time Gary? Guess your post count needs its fix

 

[mercurial]

I think I managed to remove it There was a file called WinDefence that would copy itself back to my system directory everytime I deleted it but I used HijackThis to delete the file upon restart and it seems to be gone now
PS: Thanks for the help Gary

 

[LazyLion]

Couldn't think of those questions at the same time Gary? Guess your post count needs its fix

haha... I just posted them as I thought of them.... and he needed help quick. I'm too lazy to hit the edit button... I just post in the quick reply box. Besides if he wanted to reply to any one of the issues he didn't have to sort through all of the issues!

But yes... my post count doesn't mind when I do that!

I think I manged to remove it There was a file called WinDefence that would copy itself back to my system directory everytime I deleted it but I used HijackThis to delete the file upon restart and it seems to be gone now
PS: Thanks for the help Gary

Great! Let's hope it is gone for good.

 

[mercurial]

Great! Let's hope it is gone for good.

I can confirm that it is indeed gone for good

 

[cybershark]

Thanks mercurial, I had the exact same problem on my Windows 7. Because of your posts on Firefox and WinDefence, I was able to remove it.

 

[mercurial]

Thanks mercurial, I had the exact same problem on my Windows 7. Because of your posts on Firefox and WinDefence, I was able to remove it.

Very glad to have helped