Trojan Klone AO

[luangwablondes]

I tried a free scan program, and it came up with Klone AO. Does Windows
Defender detect and remove this?

If not, besides buying another program as a once off, is there another
solution? I'm computer challenged.

 

[PA Bear [MS MVP]]

What anti-virus application or security suite is installed? What
anti-spyware applications (other than Defender)? What third-party firewall
(if any)?
===================
Microsoft has established separate newsgroups for Windows Defender support
and comments. This is not one of them. See
http://www.microsoft.com/athome/security/s...ps/default.mspx
===================
Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal...n:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2....emoving_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

luangwablondes wrote:<span style="color:blue">
> I tried a free scan program, and it came up with Klone AO. Does Windows
> Defender detect and remove this?
>
> If not, besides buying another program as a once off, is there another
> solution? I'm computer challenged. </span>

 

[David H. Lipman]

From: "luangwablondes" <luangwablondes@discussions.microsoft.com>

| I tried a free scan program, and it came up with Klone AO. Does Windows
| Defender detect and remove this?
|
| If not, besides buying another program as a once off, is there another
| solution? I'm computer challenged.

No. Windows Defende is anto spyware/adware and not a a traditional anti virus product which
is needed for a Klone Trojan.



Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/th.../HJTInstall.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Rem...o_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[PA Bear [MS MVP]]

FYI, these days just about all of us are asking first-time posters to do the
following to save time and to give us more to work with from the git-go:

1. Install HijackThis using the installer from TrendMicro but not scan:
http://www.trendsecure.com/portal/en-US/_d.../HJTInstall.exe

2. Disable Notepad: Format | Word wrap.

3. Download/run Deckard's System Scanner:
http://www.techsupportforum.com/sectools/Deckard/dss.exe

4. Save the scan results (Main.txt, which includes a HJT log)

5. And then post the contents of Main.txt as well as that of
%system%\Deckards\Extra.txt in their first post.
--
~Robear

David H. Lipman wrote:
<snip><span style="color:blue">
> Download and execute HiJack This! (HJT)
> http://www.trendsecure.com/portal/en-US/th.../HJTInstall.exe
>
> Create a HJT log file and post it in one of the below locations...
>
> { Please - Do NOT post the HJT Log here ! }
>
> Forums where you can get expert advice for HiJack This! (HJT) logs.</span>
<snip>

 

[David H. Lipman]

From: "PA Bear [MS MVP]" <PABearMVP@gmail.com>

| FYI, these days just about all of us are asking first-time posters to do the
| following to save time and to give us more to work with from the git-go:
|
| 1. Install HijackThis using the installer from TrendMicro but not scan:
| http://www.trendsecure.com/portal/en-US/_d.../HJTInstall.exe
|
| 2. Disable Notepad: Format | Word wrap.
|
| 3. Download/run Deckard's System Scanner:
| http://www.techsupportforum.com/sectools/Deckard/dss.exe
|
| 4. Save the scan results (Main.txt, which includes a HJT log)
|
| 5. And then post the contents of Main.txt as well as that of
| %system%\Deckards\Extra.txt in their first post.

Noted -- Gratzi !

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[PA Bear [MS MVP]]

David H. Lipman wrote:<span style="color:blue">
> From: "PA Bear [MS MVP]" <PABearMVP@gmail.com>
><span style="color:green">
>> FYI, these days just about all of us are asking first-time posters to do
>> the following to save time and to give us more to work with from the
>> git-go:
>>
>> 1. Install HijackThis using the installer from TrendMicro but not scan:
>> http://www.trendsecure.com/portal/en-US/_d.../HJTInstall.exe
>>
>> 2. Disable Notepad: Format | Word wrap.
>>
>> 3. Download/run Deckard's System Scanner:
>> http://www.techsupportforum.com/sectools/Deckard/dss.exe
>>
>> 4. Save the scan results (Main.txt, which includes a HJT log)
>>
>> 5. And then post the contents of Main.txt as well as that of
>> %system%DeckardsExtra.txt in their first post.</span>
>
> Noted -- Gratzi !</span>

Prego. Those logs contain a /wealth/ of very useful, often very
interesting, information and help to avoid having to ask for more info or
additional scans.

 

[David H. Lipman]

From: "PA Bear [MS MVP]" <PABearMVP@gmail.com>


|
| Prego. Those logs contain a /wealth/ of very useful, often very
| interesting, information and help to avoid having to ask for more info or
| additional scans.

Yes, I ran it.
Having information up front in a forum post would save time and it provides information that
HJT doesn't.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[PA Bear [MS MVP]]

David H. Lipman wrote:<span style="color:blue"><span style="color:green">
>> Prego. Those logs contain a /wealth/ of very useful, often very
>> interesting, information and help to avoid having to ask for more info or
>> additional scans.</span>
>
> Yes, I ran it.
> Having information up front in a forum post would save time and it
> provides
> information that HJT doesn't.</span>

I thought you'd like that! <eg>

 

[BoaterDave]

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message
news:ex9nzWjiIHA.5504@TK2MSFTNGP05.phx.gbl...<span style="color:blue">
> David H. Lipman wrote:<span style="color:green"><span style="color:darkred">
>>> Prego. Those logs contain a /wealth/ of very useful, often very
>>> interesting, information and help to avoid having to ask for more info
>>> or
>>> additional scans.</span>
>>
>> Yes, I ran it.
>> Having information up front in a forum post would save time and it
>> provides
>> information that HJT doesn't.</span>
>
> I thought you'd like that! <eg></span>

Shows up the weak spots, eh? !!

BD