Trojan Horse Downloader.Keenval.B (C/D)

thomas_catlett

Although AVG removes these trojan horses, I somehow keep on re-acquiring it. Can't I do anyhting to prevent this from happening? Please help...Thanks

Marianna · Posted: Sat Apr 17, 2004 1:12 pm Post subject:

HI,

I "think" this is the reason why - have a look here:

http://www.doxdesk.com/parasite/KeenValue.html

virus_guy · Trooper Joined: Apr 16, 2004 Posts: 31 Location: Pakistan

just remove the program called "Keen value" using add/remove programs in your control panel as stated by the article whose link Mariana gave..if you're a newbie with computers then don't choose the manual method as its too confusing..
Its weird that avg cannot completely remove the trojan..is your avg up to date?

Also..you should download and use a program called Spyware search and destroy..its an awesome program that checks your computer for spyware and removes them or does whatever you want to do with them.I've heard some excellent reviews about this software from some friends,i've also tried it myself and its really good.And best of all,its free.You can download it from:
http://www.safer-networking.org/

thomas_catlett · Posted: Sun Apr 18, 2004 9:35 am Post subject:

okay thanks...

bout the program spyware search and destroy...i have spyware blaster. are they they the same? can i do without the other? also, i have ad-aware, but everytime i run my kazaa, it goes nuts...please advice. thanks again for your help. i really appreciate it.

virus_guy · Trooper Joined: Apr 16, 2004 Posts: 31 Location: Pakistan

the program goes nuts because kazza attempts to download spyware to your computer.Try searching for a program called "Kazza Lite".Kazza lite is Kazza that has been modified by a programmer so that it won't download spyware to your computer..remove kazza and use kazza lite.
About spyware S&D and spyware blaster..i'm not sure but i think that they should be the same if you use spyware blaster correctly.I've never used Spyware Blaster but i use Spyware S&D and its great.Anyway..have you scanned your computer using Spyware Blaster?If yes,then what results does it give?if no,then do it now and remove all the spyware that it gives.However try backinng up the things before removing them so that if any of your good programmes get affected you can easily undo the damage.I don't know how to do that with Spyware Blaster,may be someone here can tell you how to??

shifu17 · Cadet Joined: Apr 23, 2004 Posts: 2 Location: Singapore

hi, i have the same problem. my AVG detects keenval.b every now and then...more or less at least once each time i restart my com but when i scan the directory indicated or my whole hdisk, it doesn't find anything.

i've tried what was suggested in
-> http://www.doxdesk.com/parasite/KeenValue.html
*regedit and everything, could not find keenval anywhere at all

and i've used the spybot search n destroy thing as well but i still have the problem. any ideas what's wrong?

maciel · Cadet Joined: Apr 26, 2004 Posts: 1 Location: Brazil

Oh, my God !!! The same thing happens to me !!!
Any new idea? PLEASE HELP ME !!! Crying or Very sad

PC_Sniper · Cadet Joined: Apr 27, 2004 Posts: 1 Location: USA

You will continue to get the VIRUS if it is located in a System Restore file. (Windows 98SE/ME/XP) Somewhere along the line you or your pc backed itself up with the Virus before AVG could detect it. Mind you, a trojan is only detected when it changes/opens up/or executes. Check the location of the file. You may have to whack it from DOS. You will have to emmulate DOS in XP.

claire · Posted: Fri Apr 30, 2004 5:00 pm Post subject:

Jackyyp · Private Joined: Apr 30, 2004 Posts: 35 Location: China

You can do this:
Updata your system,AntiVirus Sofeware and firewall.

Jackyyp · Private Joined: Apr 30, 2004 Posts: 35 Location: China

I must be in the course. Try to find it.

kewlkat69 · Cadet Joined: May 01, 2004 Posts: 1 Location: USA

i have the viruse in sistem restore information how do i delete it ?

cesalima · Cadet Joined: May 30, 2004 Posts: 1 Location: USA

Hi. I have the same problem. I have tried all the suggestions, have downloader TrojanHunter, followed the directions to do the live update with the evaluation copy, checked for KeenValue in my Add/Remove Programs, I don't have it. I have Trojan Horse Downloader Keenval B and all the above options did not work. AVG keeps detecting it, but can't find it in a virus scan. XoftSpy can't find it. Trojan Hunter checked everything, and I saw it scan the particular file: A0009898.exe and declare it clean. But AVG keeps telling me the trojan is there with this message:

c:\system volume information\_restore{003c7423-effd-4dab-82ud-2bb34f7a05eb}\RP29\A0009898.exe

I noted in one of the postings that I might have to make the change in DOS. I have XP. You said I might have to emulate DOS ... how and specifically, what change do I make?

I'm getting my Symantec Internet and Virus Protection back on Monday (my hard drive went south, got a new one and didn't want to pay for a new virus protection when I already had a valid subscription. My bad.)
and should have no problem getting the virus again. But I have to get rid of it now. Please help me.

claire · Posted: Sun May 30, 2004 10:37 am Post subject:

We need a snapshot of your running processes..........but First:
Virus=Read This: http://www.computercops.biz/postt8864.html
HiJack= Read This: http://www.computercops.biz/postt911.html

Download : HiJack This!

Create and Unzip to a folder not your Desktop or the Temp folder, doubleclick HijackThis.exe, and hit "Scan".
Unzip the download (using a piece of software like: Winzip)

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log in a text file, and post it in the CCSP "Spyware - Hijack Related" forum:

http://computercops.biz/forum67.html

Most of what it lists will be harmless or even required, so do NOT fix anything yet.
Someone here will be happy to help you analyze the results.

Marianna · Posted: Mon May 31, 2004 5:12 pm Post subject:

Hi cesalima

Trojan Hunter checked everything, and I saw it scan the particular file: A0009898.exe and declare it clean. But AVG keeps telling me the trojan is there with this message:

c:\system volume information\_restore{003c7423-effd-4dab-82ud-2bb34f7a05eb}\RP29\A0009898.exe

You have to DISABLE system restore - here is HOW:

http://www3.ca.com/securityadvisor/news...?cid=49579

Don't forget to make a NEW restore point !

HTH


	Home ˇ Topics ˇ Submit News ˇ Top 10 This entire site, Cops Themes, and Computer Cops are Š 2002 - 2004 Computer Cops, LLC. All rights reserved. You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0. Acceptable Use Policy. Use signifies your agreement. Engine Copyright Š 2002 by PHP-Nuke, GNU/GPL Licensed. ICRA Member. Paul Laudanski, Member of Computer Cops, LLC Server Load: 1490 pages served in previous 5 minutes. Page Rendered: 0.429 seconds.