Trojan found on my system

Anyone please help!! I bought a program off ebay and found out it was a pirated copy and then my computer has been acting goofy. Yahoo antispy found a trojan yesterday and said it was removed. I found a file and in doing research looks like a spy program. tfsnifs.sys

I have also had some win 32 errors. How do I get my system back to normal....the program I purchased was Adobe Software suite and I realized when I went to install was pirated when it had crack folders on it with key generators. Any help would be appreciated.

Sunshinesluv47

tfsnifs.sys is part of DLA. IIRC DLA is Drive Letter Access and is used so you can access your burner through the explorer interface to burn files.

So you probably nuked something that shouldn't be nuked and now your system is complaining about that. Use System Restore to restore your system.

Did you catch the name of the trojan?

No it didnt say it just said found a trojan and deleted it. The Win 32 errors were before I deleted the trojan....I'm guessing i need to reformat.

Maybe, maybe not. What kind of errors are you getting?

Generic Host Process for Win 32 services

szappname: svchost.exe
szappver: 0.0.0.0
szmod name: unknown
szmod ver: 0.0.0.0

files:
C: Docum~1/sunshine/locals~1/temp/werdd3f.dir00\svchost.exe.mdmp
C: Docum~1/sunshine/locals~1/temp/werdd3f.dir00\appcompat.txt

Not sure what this all means but all I could come up with....thanks for help!

I have been able to fix win 32 errors by reapplying service packs

what os are you running??

also running av and antispyware in safemode

MLF

I am running XP

Quote:

---

Originally posted here by sunshinesluv47
Generic Host Process for Win 32 services

szappname: svchost.exe
szappver: 0.0.0.0
szmod name: unknown
szmod ver: 0.0.0.0

files:
C: Docum~1/sunshine/locals~1/temp/werdd3f.dir00\svchost.exe.mdmp
C: Docum~1/sunshine/locals~1/temp/werdd3f.dir00\appcompat.txt

Not sure what this all means but all I could come up with....thanks for help!

---

Oh boy. I smell a RAT...

Do you have a virusscanner? Is it up2date? You might want to scan your PC for virusses.

You can do an online scan at TrendMicro's site and Panda Activescan

Yes I have Norton 2004 and did scan with new updates and didnt find anything

doing Trendmico now!

It found:
cookie 1020
cookie 2060
cookie 2842
spywbigbro.10
hktlbrutforce.a

Trend micro found:
cookie 1020
cookie 2060
cookie 2842
spywbigbro.10
hktlbrutforce.a

Quote:

---

Did you catch the name of the trojan?

---

Quote:

---

No it didnt say it just said found a trojan and deleted it

---

- Your Antivirus should have a certain kind of LOG about the Trojan that it had removed. Please check the LOG of your AV.

Yo!

How about emptying your temp folders?

Boot into safe mode:
Go to Start>Run> Type in cmd then type in the following:
del C:\documents and settings\sunshine\local settings\temp\*.*

That will clear most everything out of your temp folder. TrendMicro and other scanners won't remove them if they are in use. It might be a good idea to download a free AV, such as AntiVir, or AVG, and run them in safe mode. Or if you already have an onboard AV, then run it in safe mode.

I wrote a page on cleaning a Windows PC and Majorgeeks has a great one too. Follow either one step by step and your system will be fine.

http://www.rightcoaster.com/Malware.htm
http://forums.majorgeeks.com/showthread.php?t=35407