Skip to main content

How to Remove Trojan Virus for Free

Why is it difficult to remove trojan virus

Because trojans are a very common type of malware that is known to practically all web surfers, it is clear how hard it is to answer the question "how do i remove a trojan virus from my computer?"

A trojan virus makes a PC user think that it is a beneficial Windows application. Thus, trojans often masquerade as screensavers, packages of video codecs, tray clocks, weather forecast software, messengers, etc. Another major source of trojans is all kinds of illegal programs, cracks and keygens. It is a common practice to include trojans into free antivirus software distributed via peer-to-peer networks (e.g. torrents). This is especially dangerous for end-users because antivirus program cannot detect a trojan before the installation finishes and all updates are downloaded, thus the use of free antivirus software downloaded from suspicious websites or sources imposes a great risk on personal computers.

Moreover, one of the most difficult things in PC maintenance is to remove trojan virus from a PC where software of a suspicious origin has been installed. 

TOP-10 Internet Threats (July, 2008), by: BitDefender,

TOP-10 Internet Threats (July, 2008), by: BitDefender,

What is a Trojan Virus

BitDefender, a world renowned antivirus software maker, conducted a research based on its statistics. Its purpose was to show which types of threats dominate the Web. The results are shown on the screenshot to the right. -->

It's clearly seen that nine out of ten most encountered threats are trojan viruses.

The first trojan in the list, Trojan.Clicker.CM, displays commercial ads, which "eat" the bandwidth and, as a consequence, slow down the PC.

It should be pretty evident that methods to remove trojan viruses should quickly adapt to the reality, since trojans lead the malware army.

So before learning how to remove trojan virus, it is important to know what this type of malware is in essence.

In short, as the term suggests, a trojan pretends to look and act like it's a legit Windows application. However, its malicious code is programmed to execute operations that no PC owner would want on his computer. 

  • Trojans are capable of stealing important information (passwords, credit card numbers, etc.) Then the sensitive data is transmitted over the Web to virus creators, who then are able to take control over infected computers. 
  • A considerable slow-down in system performance is one of the consequences of trojan virus infection.
  • A user may be distracted by unexpected pop-ups with ads (mostly with casino, poker, adult content).
  • Trojan viruses attempt to become parts of the infected system by interacting with Windows processes and injecting malicious code into legitimate files executed by the operating system (Winlogon is an example of such injection when a trojan virus is fully loaded after the user enters login details).

Trojans may get involved into distribution of unsolicited emails. Sometimes this type of malware is responsible for attacks on other computers connected to the Internet. While it's a bit scary, in fact any PC infected by a trojan virus may be engaged in decentralized attacks on servers of government institutions, universities, etc.

How Trojans Spread

A trojan virus uses multiple ways to spread over the Web and replicate itself. That's why if you want to know how to remove the trojan virus, you need to be aware of the ways it infects target computers.

  1. Through email attachments. Probably the oldest method of mass distribution, it has grown into a new industry of virus propagation. Modern sophisticated software, dedicated servers, large networks of already infected personal computers are used to send out gazillions of spam emails each and every day. A trojan virus may be attached as a greeting card, wallpaper, animated image, screensaver. Many of them have subjects with "hi, here's a greeting card for you!" words.
  2. Once downloaded and executed, a trojan may use the address book to send itself to other computers. That's why it is still worth noting that emails from unknown addresses should never be opened.
  3. Trojans widely exploit messaging software, especially popular programs like MSN Messenger/Live Messenger, Yahoo! Messenger, Skype, etc.
  4. Trojans may be included into bundles of emoticons for email clients and instant messengers alike.
  5. Modern Trojan viruses widely exploit security breeches in Windows Operating system and the popularity of multimedia content available online. For example, zlob trojan, responsible for aggressive distribution of over a hundred of fake antispyware programs, used video codecs to install onto target computers. Whenever a surfer visited a website with embedded malicious code, a window would pop-up asking to install a video codec in order to display a movie. Once the visitor clicked to agree to installation, trojan Zlob infected the system immediately.
A Trojan Virus generates fake alerts

A Trojan Virus generates fake alerts

Trojans and Rogue Security Software

Trojans have gained an even worse reputation because of rogue security software which they distribute. Rogue software are bogus programs that pretend to look and act like antivirus or antispyware applications, various system maintenance tools, registry cleaners, etc. They use fake malware scan results and persistent pop-ups trying to scare the user into paying for a "full version" of the program. However, even getting a license key in exchange for some $30 or $100 changes nothing in the way rogue security software behaves. Even annoying pop-ups continue to appear on the desktop at same intervals.

I believe many people became more aware of Web threats thanks to rogue programs, because they got interested in the nature of this phenomenon, which led them to learn something about how to remove a trojan virus.

How Can I Remove a Trojan Virus from my Computer

While it is possible to remove trojan virus manually, the set of steps involved in PC cleaning requires a decent level of computer experience. There's a need to indentify the type of malware, to locate infected or harmful files and registry entries, to download the tools that will help to remove trojan virus.

A common practice implies the use of special software, commonly referred to as 'trojan removers'. It is however important to point out that this type of programs makes a considerable part of antispyware software market, which is a big incentive for some programmers to make quick money by releasing trojan removers with mediocre scanning engines, poor algorithms, and no support.

Therefore I feel it's necessary to warn you, the readers of this hub, that the decision about preferable trojan remover should be done after at least basic research of the available programs. User feedback and reviews are important sources of information, though the quality of reviews of trojan removers often leaves much to be desired.

Scroll to Continue

NOTE: Every program recommended in this hub is 100% safe to use. I give as detailed descriptions as possible, with an accent on vital features not to be found in competitors' software. Same applies to any download links given below.

Some folks prefer to remove trojan virus for free. I myself am a big fan of freeware tools, but there's a big problem here. Some developers of scam software promote their products as free trojan virus removers, to entice web surfers into downloading and installing them. However, such free trojan removers are often more dangerous than trojans. Even scanning of executable files by antivirus programs may show them as clean. This is yet another reason why I advise to make some research before downloading and installing any software that promises to help to remove trojan virus.

Online scanners are an absolutely safe and free way to remove trojan virus. All major antivirus software makers offer online virus scanners on their websites, and these services are available for everybody enjoying a stable Internet connection. Not all of the scanners have same detection rate, and they differ in types of malware they're able to remove.

For trojan viruses involved in the distribution of rogue security programs, there are special tools developed by volunteers. These tools have a very specific targeting and are meant to fight either certain trojans, or a range of malware. Usually such tools are created because major antivirus and antispyware companies fail to address new threats quickly. This happens either due to bugs in scan engines, or requires significant updates.

Command-line anti-malware scaners present another way to remove trojan virus for free. Sadly, I was able to find only two completely free and available scanners: TrendMicro SysClean and a-squared anti-malware command-line scanner. The latter is suitable for PC users with intermediate experience, while TrendMicro software is aimed at advanced users or system administrators.

Remove Trojan Virus as soon as you caught it

I'd say this goes without saying; any trojan virus should be removed as quickly as possible.

  • you never know what it managed to do in your system, and what it still intends to accomplish.
  • a trojan virus rarely is the only guest in the PC system; most of the time its buddies come alond quicker than you wink.

Pretty obvious, right? But many people consider dangerous only those types of malware which distract them from work or mess up PC settings. With trojans, the whole system may work more or less normally for a long time. Trojans are designed to attract as little attention on part of the user as possible.

Best Trojan Removers

Whenever I'm asked to name a couple of best programs to remove trojan virus for free, I find myself speechless. It's just impossible to find the best program in the world of security software. Not because there are tons of them (and new products appear monthly), but because what is best and what is worst is a subject to debates. I prefer to put it mildly: best Trojan remover is only an addition to safe browsing habits and responsible surfing.

In case with free trojan removers, the situation is changing all the time. Several years ago IT pros would name TDS-3 among best of breed programs created to remove trojan viruses. But the program ceased to exist, its support was discontinued. Other products appeared on the scene as promising trojan fighters, but their developers either lost enthusiasm or quit the programming, leaving the software 'half-cooked'.

So in brief, what was well-performing yesterday, might have been left in dust by new products. Some of the old players managed to keep up the pace, too. Therefore my short list of software effective in removing trojan viruses includes only programs that scored awards from trusted reviewers and security labs. I personally tested each program to ensure none of them contains serious bugs.

It is worth noting that popular antivirus software and Internet Security Suites from world-renowned manufacturers show relatively weak trojan virus detection. Even identified trojans happen to be too tough for an antivirus to erase them from the system. There are practically no exceptions to this sad fact; no matter what antivirus industry leaders promise to potential customers, their products perform as trojan cleaners with imperfect algorithms.

Malwarebyte's Anti-Malware: strong heuristics & Realtime Protection Module

Malwarebyte's Anti-Malware: strong heuristics & Realtime Protection Module

Malwarebyte's Anti-malware

SuperAntiSpyware with Direct Disk Access

SuperAntiSpyware with Direct Disk Access

SUPERAntiSpyware v5

  • SUPERAntiSpyware
    Remove over 1 MILLION of pests instantly! First Chance Prevention and Registry Protection, Real-Time Blocking. Detect and Remove Spyware, Adware, Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers and many other types of threats.


Dale Anderson from The High Seas on May 13, 2018:

Used them both and, in fact, have been using them for years. Big fan, especially of superantispyware.

thessa on July 26, 2015:

How can i remove the trojan virus without the risk of my fb account?

Grazie on November 28, 2012:

how can i remove trojan virus in my computer? as soon as possible?

Kas on July 09, 2012:

Kaspersky is the best

charlemont (author) from Lithuania on June 09, 2012:

Have a look at avast! Home Edition or Avira Free Antivirus. Both provide real-time protection.

Kathy on June 09, 2012:

I'm looking for a free, but very good antivirus program are there any such thing out there anymore.

charlemont (author) from Lithuania on April 02, 2012:

cressette, what software did you use for scan?

cressette on April 01, 2012:

hi trojan is damaging my computer i try the free scanning am not sure if i did it right but i try but its still there, it already crash one of my laptop dont want the same please help!!!!

cressette thank u

charlemont (author) from Lithuania on February 06, 2012:

Hi Whitney, please check if you're able to log on in Windows Safe Mode (tap F8 key continuously when restarting computer until Windows Boot Menu appears). Chances are, we can get rid of the trojan without buying anything. You can always contact me via email at this link:

Whitney on February 05, 2012:

Got the Trojan virus that pops up as security warnings...this has disabled my internet. Any suggestions on software? Kaspersky or Webroot...anything I can get from BestBuy.

charlemont (author) from Lithuania on January 17, 2012:

paul, if you can't use computer, I suggest that you should create a rescue CD using another computer and then scan the infected one.

Here's a short tutorial with download links:

I recommend Avira AntiVir Rescue CD, but it's up to you which to use.

paul on January 17, 2012:

we have picked up what seems 2 be a cracked screen virus although can not use the computer at all to fix it...can u give me any advice on what to do next in order to remove it..ty..ty..ty

charlemont (author) from Lithuania on January 02, 2012:

tia, please drop me an email using 'contact charlemont' link found below my profile photo.

tia on January 02, 2012:

im in the exact same situation as 'Cathy S' please help asap!!!

fghfhhfg on December 31, 2011:

thank you

guywholikestodownloadfreethingsandthengetsvirus on December 27, 2011:

i just downloaded avg anti virus for free of course and it detected js/agent.l wich i later googled and found out was a trojan virus and script/pdf.exploit. what do you think of avg anti virus

CathyS on December 25, 2011:

I got a Merry Christmas present that my computer was hacked at Christmas eve. The IE wouldn't work, keep pop-up alerts and trying to make me purchase some Windows7 2012 security suite. Meanwhile the local files work very slow. I have subscribed McAfee, and I did a full scan, it reported one file was infected but enable to delete the file. My computer is Windows 7, 64 bit. Which way is easier to clean the computer and productive, use some of your recommended free software to clean or to restore the windows system? I'm not very skilled with IT knowledge, but I can follow instructions to get around when it comes to computer maintanence. Please help me !!

charlemont (author) from Lithuania on December 25, 2011:

kathleen, please download Avira AntiVir Rescue System:

Get .ISO file and use any burning software to burn the .ISO file on a blank CD-RW (or DVD-RW). If you don't have any burning software, I recommend IMGBurn, which is totally free.

Once you're through, please drop me a message using 'contact charlemont' link on this page, below my profile photo. Include your laptop model.

I think you'll have to remove Morton (because it's expired) and install some other antivirus software.

kathleen on December 24, 2011:

I surely hope you can help me my laptop has a trojan horse virus i was able to find that much out what is the best way and safest and cheapest way i can go im on a fix income and if i can find a free way that would be totally awesome. im able to get on the internet by going though norton wich came with my laptop but has expiredi go to account then it open up the internet. i want this problem fixed asap i really do. i have a cd/dvd on the side of my computer so please any advise would be greatly appreciated a lot. Thank You and have a very Merry Christmas Kathleen

charlemont (author) from Lithuania on December 19, 2011:

shahrul, please contact me via 'contact charlemont' link below my profile photo on top of this page. Describe your problem, version of Windows, 32-bit or 64-bit.

shahrul on December 19, 2011:

i cannot able to removet this trojan thing. it break my heart. my windows is infected with trojan. please. help mee

charlemont (author) from Lithuania on November 10, 2011:

Diana, last time one of the new superantispyware users found 245 infections, will you score more? ;-)

Once the scan has completed, delete all what it has found, then restart.

Create a HiJackThis report:

and email it to me using 'contact charlemont' link below my profile picture (on top of this page).

You can download HiJackThis here:

(Get v2.0.4 executable)

Include the following info alongside HJT report: is your Windows 32-bit or 64-bit, and do you have DVD drive.

Diana on November 10, 2011:

Please help me! My laptop was infected by viruses, particularly Trojans. I installed the superantivirus on safe mode and the first time, it froze while installing. I restarted and am installing it again, and the number of threats detected has jumped to such a crazy number!! Please help :(

charlemont (author) from Lithuania on November 08, 2011:

dion thompson, what did you purchase?

dion thompson on November 08, 2011:

my purchase didn,t go thru why

charlemont (author) from Lithuania on November 07, 2011:

Steph, sorry for my missing the point. Don't know why I thought you were looking for a free antivirus.

Consider EMSISOFT anti-malware:

Or G-Data:

I suggest that you should pay a visit to to have a look at test results (Proactive).

Steph on November 07, 2011:

Thanks for your response! So you think that F-secure is better than McAfee? I don't mind paying for a program, I just want the best one available. McAfee Total Protection seemed quite robust, but I heard it wasn't the best one to use.

charlemont (author) from Lithuania on November 07, 2011:

Hi kb, I suggest that you should download Avira AntiVir Rescue Disk:

Then, depending on whether your computer has a DVD drive, you can either burn the .ISO image file to a blank CD-RW / DVD-RW:

or make a bootable USB stick (512 MB at least):

Contact me using 'contact charlemont' link below my profile picture on this page with any questions, I'll try to get back to you in under 24 hours.

kb on November 07, 2011:

Hi Charlemont

Glad to have found you. Am in Safe Mode cannot run or install any of the AV freeware above. Have a virus that literally sqeals like a pig, and dissallows me to open anything except pictures. Most likely from a Project Free TV site, in any case my daughter was watching a movie and all of sudden one of those Security Scan (Scam) program starts, runs a scan (found Backdoor, Trojan) and was still running until I shut it down. Any thoughts? I am desperate!! Thank You.

Tiffy on November 06, 2011:

Never mind. I have just reformatted my computer, so the virus is gone now. Thanks for the help anyway. :)


charlemont (author) from Lithuania on November 06, 2011:

Steph, right now F-secure & Chip magazine are carrying promo - 1 year subscription to F-secure Internet Security 2011.

I had to use a shortened URL because original one is way too long to paste here. You can put in the fields whatever you wish, just use a valid email address to get a license key ;-)

Among free antivirus editions you can choose avast!, AVG, Comodo, Avira. Keep Malwarebyte's no matter what antivirus you decide to have.

Steph on November 06, 2011:

Hi, my subscription for McAfee Total Protection is coming to an end and before I renew it, I am curious if there is a better all-around anti-virus software I should use? I also use Malwarebytes to run occasional scans.

charlemont (author) from Lithuania on November 05, 2011:

Tiffy, is your laptop equipped with dvd-drive?

Tiffy on November 05, 2011:

Hi Charlemont,

I downloaded HiJackThis, booted into Safe Mode, opened HiJackThis, then clicked on the first button one that lets you scan and create reports.

While it was scanning, HiJackThis crashed, so I tried opening it again, but the same message appears as the other antivirus, "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.". So now I couldn't create a log file.

I hope you could help. Thanks!


charlemont (author) from Lithuania on November 04, 2011:

Hi Tiffy,

please download HiJackThis:

Then boot into Safe Mode:

and create a report:

Once you have the report (logfile), use the 'contact Charlemont' link below my profile picture to email me the contents.

Tiffy on November 04, 2011:

Hi Charlemont!

I have a Trojan virus on my laptop, Windows 7. I'm sure of it because the computer detected the virus through the "Solve PC issues" icon in the right part of the taskbar. But when I try to delete the Trojan virus, the computer couldn't delete it.

I tried downloading Kapersky Scan, Malwarebyte's Anti-Malware, and SUPERAntispyware v4. Unfortunately,this message keeps popping up whenever I try to open any of the anti-virus: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." Now I can't remove the virus already. By the way, this message also pops up whenever I go to Google Chrome, Autorun, and other programs.

I'm really desperate, I don't want to lose my computer forever. :(

Is there anything I could do to remove the Trojan virus?

Thanks a lot in advance! :D

charlemont (author) from Lithuania on November 04, 2011:

chris, are you able to log on to desktop? Are there any error messages popping up? What software have you tried already? What windows version are you running?

chris on November 03, 2011:

hey charlemont i started to get this Trojan virus that makes my hard drive unreadable and i have tried many forms of trying to clean out my computer. do you have any advice on which program i should use to solve my situation?

it would mean a lot

charlemont (author) from Lithuania on October 31, 2011:

Hi Sal, did you run superantispyware in Safe Mode? Sometimes it makes sense to run full scan 2 times, not 1, restarting computer after first scan.

Anyway, please create a HiJackThis report as advised here:

Use 'contact charlemont' link below my avatar on this page to include the contents of logfile (copy-paste and send just a regular email).

Sal on October 31, 2011:

Hi, I have serious problems, I used

SUPERAntiSpyware and deleted viruses, but

trojan is still in my computer!

PC is crashing all time, only sometimes

it wont , but thats for a little time....

please help me

charlemont (author) from Lithuania on October 28, 2011:

Saz, I think you should ask webhosting customer support to check your website directory for infections.

Regarding your computer, those entries that have been placed in the vault are harmless. Sluggishness can be the result of infection, but that doesn't mean there are still malicious items left active. Please drop me a message via 'contact charlemont' link below my profile picture specifying your Windows version, 32-bit or 64-bit, and if there's a DVD drive.

Saz on October 28, 2011:

Hi Charlemont,

Thank you for posting this article.

I am having problems also and not sure how to go about dealing with this myself and wondered if you could offer some advice...

AVG reports several threats and infections (Trojans and malware) in the virus vault. Been there for a while. I have run AVG and malware bytes and both show the system as being infection free other than what's in the vault.

However, I just know this is not the case. The laptop is still sluggish despite being tuned up regularly and having minimal files etc and when logging onto internet (using firefox) often freezes up. Sam when trying to open some programs.

Have been emailed recently about my two websites, and been informed that when some people visit they are being blocked due to Trojan Horse viruses. Again, run multiple tests and cannot find anything. Feels like I'm chasing my tail.

Can you suggest anything? Would really appreciate it. Have taken a screen shot of the infections in the vault for information.

Look forward to hearing from you.

Best Regards


charlemont (author) from Lithuania on October 11, 2011:

asad, I suggest that you should run any of the free online virus scanners to start with:

If virus infection is detected, drop me a message via 'Contact charlemont' link below my profile photo on top of this page.

asad on October 10, 2011:

hi charlemont

u r helping lots of people here, i hope u can help me too. my computer freezes everytime i connect to internet. i dont know its a trojan or what. can u help me plz.

charlemont (author) from Lithuania on October 10, 2011:

Hi Herle, thanks for stopping by! I'm sure your comment will inspire other frustrated users whose computers are invaded by virii.

Herle Donor on October 09, 2011:

Hi charlemont!

I really had a problem with my sister's laptop. It was infected with Trojan virus. I read the comments here on your page and followed your instructions to some who asked your advice. I was hoping that it will work (with crossed fingers) AND IT DID! I was so happy and very grateful!


charlemont (author) from Lithuania on October 06, 2011:

sofed, please contact me via 'contact charlemont' link on top of this page (under my profile photo). Please include details about your Windows version (XP, Vista, 7, 32-bit or 64-bit) and computer type (desktop, laptop, netbook). Most likely you will need a second PC with a working DVD burner and access to the Internet. I'll get back to you once I get en email from you.

I will remove the post with the link, thanks for letting me know. Spammers gather in flocks these days ;-)

sofed on October 06, 2011:


My husband downloaded an application a couple weeks ago and got a trojan virus. Avast alerted the computer and ran a scan and showed 3 trojan virus. It disabled our internet, avast, and other programs. I attempted to download superantyspyware, kaspersky virus removal tool, malwarebytes, and mcafee virus removal tool and none are complete the download process indicating that the downloads are not capable with the system. I inserted System Suite repair disk and nothing will download. I downloaded the Kaspersky virus removal to a usb flash and inserted to infected computer in both safemode with networking and normal modes and I still cannot download.

Do you have any ideas or recommendations for me?

p.s. i went on the website posted by one of your guests 2 days ago and the site looks to be suspecious... do you know anything about that site?

ann. on October 01, 2011:

u piece of shit, aint nowhere in this where i read that it actually says or tell u how to delete them...

hassan on September 27, 2011:

one of the best

charlemont (author) from Lithuania on September 24, 2011:

Camie, I can't send you email, messages are bounced back as undeliverable.

charlemont (author) from Lithuania on September 22, 2011:

jim, it's unlikely a virus deleted files and made them unrecoverable. Perhaps it made system unbootable? I received your email and will reply back soon.

jim on September 22, 2011:

hi i got the trojan virus and it wiped out my whole hardrive what should i do?

charlemont (author) from Lithuania on September 22, 2011:

@PH, reformatting the whole hard drive it will destroy any virus.

@PH on September 22, 2011:

...Will Reformatting the PC remove a Trojan Virus(Keylogger)?

charlemont (author) from Lithuania on September 14, 2011:

eve, yes it's safe to install superantispyware side-by-side with antivirus.

What kind of trojan problem are you facing?

eve on September 14, 2011:

can i use the superantispyware even i already installed anti-virus in my computer? i also suffered the Trojan in my computer. please help.

charlemont (author) from Lithuania on September 09, 2011:

sandra from ph,

if you're still facing this problem please drop me a line by clicking 'Contact charlemont' link below my photo on top of the page.

charlemont (author) from Lithuania on September 09, 2011:

emma, is your Vista 32-bit or 64-bit?

charlemont (author) from Lithuania on September 09, 2011:

jiam, contact your bank or credit institution immediately!!! They should disable oll transactions with your credit card.

If you're still having problems with security warnings on your desktop please contact me using the Email link on top of this page below my avatar photo (Contact charlemont).

charlemont (author) from Lithuania on September 09, 2011:

Sorry everyone for a delay with replies, I just got back from a sea cruise.

isha, usually a virus gets into a computer being downloaded from the Internet. But of course it can be transferred as part of files copied from external hard drives, data CD/DVD's, floppies, etc.

isha on September 04, 2011:

i just want to ask that for installing a virus from net we have to download it first or follow any other procedure

jiam on September 01, 2011:

hello, my laptop is just got attacked by the risky virus ( I guess trojan ) and it showed me to activate the security to remove the viruses so, i tried to pay through credit card but everything went bad. I am scared of they might excess the all information about credit card and the internet information. plz help me with anything you know and what should i do?

emma on August 29, 2011:

Hi charlemont!

i need you expertise

actually my p.c is facing the kinda trojan which eats up the bandwidth as well as slow down the PC.

m really stuck dunno how to get rid

m using hp notebook with vista home premium .

m an intermediate level user.

cau you give me any sugession to fix it


sandra from ph from Philippines on August 27, 2011:

Hi charlemont!

I need your expertise.

My son son's laptop got a nasty trojan, located aat C:\Windows\Autokms.exe

most of his program files and applications have the Adobo logo. I ran an avira scan but only identified this threat but nothing happened after quarantine. Cannot run ANY program. Downloaded Microsoft security essentials in a separate usb (from another laptop) restarted in safe mode and tried to run, cannot. Also cannot connect to internet even on safe mode with network.

honestly dont know what else to do. I really appreciate your help.

thank you so much in advance!


CompuClinic from Provo, UT on August 08, 2011:

This is a very good beginner's guide. Thanks for helping to stop the spread of this filth.

charlemont (author) from Lithuania on July 22, 2011:

Enning, if you're running XP, Vista or 7, download superantispyware, restart computer. Press F8 key and hold it until Windows Boot Menu appears. If you miss it, restart again. In boot menu, highlight Safe Mode with Networking using cursor keys, then hit Enter. Logon, locate the setup file you downloaded earlier, right-click on it, choose "run with administrator rights". Install. Superantispyware will attempt to download updates. Once an icon appears near system clock, right-click on it, choose upper menu "scan for adware, spyware, malware".

Enning on July 20, 2011:

my computer has bein attacked by virus all the icons on desktop are highlited by the virus and it has also make it work slowly

charlemont (author) from Lithuania on July 09, 2011:

Dean, I'm happy you're over with the virus infection. Did you use superantispyware?

As to deleted files on the external hard drive, I still think they're there. For total wiping files need to be erased byte by byte, which takes a very long time, and frankly, it is uncommon for viruses to be that persistent in file deletion.

Software like Get Data Back for NTFS (I assume your external HDD uses NTFS file system because it is huge) can be used to scan the storage device.

Or still better, contact someone with sufficient experience to perform the task. Just do not write anything to external HDD until data is recovered!

Deano on July 09, 2011:

I just wanted to thank you for all your help and advice. I have removed the virus from my laptop and I am now trying to recover my files. Thanks again, you're a star. Dean

Deano on July 07, 2011:

Thanks for the advice. I will have ago. I did download the infected file on to the external drive! I tried to delete once I realised what was happening. As it wouldn't delete I cut and paste it into my d drive hard drive on my acer laptop. I will do as you say and let you know what happens. Thanks again for your help and advice.

charlemont (author) from Lithuania on July 07, 2011:

Deano, I assume you did not write anything on the hard drive. There's a greater chance for successful data recovery if no data is written on a drive.

For now, download SUPERAntiSpyware and store it on a thumbdrive or USB flash drive. Turn on laptop and keep tapping F8 key until you're brought to Windows Boot Menu. You should be given several options, Safe Mode with Networking being one of them. Highlight it and hit Enter. (If you miss the moment and Windows starts to load normally, simply restart).

When in Safe Mode, plug in USB flash drive (with SUPERAntiSpyware setup file stored on it), double-click the executable and install. Superantispyware will attempt to download updates from its servers. If your Internet connection is active, update will complete.

Right-click on the SAS icon in the system clock area (it looks like a yellowish 'bug'), choose Scan for Spyware, Adware etc. Drive C:\ needs to be checked for malware. When the scan is finished, remove detected infections if asked by the program. Then restart and log on normally as you always do.

Deano on July 06, 2011:

Thanks for getting back to me. I've unplugged the hard drive and saved what I could. I'm using xp operating system if that helps. I've check the recycle bin and they are not there. The strange thing is they literally just vanished, over 700 gb of stuff. Any advice would be gratefully received.

charlemont (author) from Lithuania on July 06, 2011:

Hi Deano, what operating system is installed on your laptop? XP, Vista or 7?

I'm not sure if files/folders on external hard drive are non-recoverable. Perhaps they've been moved to the recycle bin (so they can be restored by using the Restore option once you right-click on files stored in the recycle bin). Anyway, until malware is removed, do not connect external hard drive to your laptop.

Deano on July 06, 2011:

Help! Using my iPad as laptop is deleting everything I open. I downloaded a password cracker and then my computer suddenly deleting every folder I opened. My laptop was connected to my external hardrive with every file I have. I now seem to have lost years of work, photos, movies, music and much more. I have un plugged my external drive and copied what I could on to my pc. Avast said I had a Trojan attack but it blocked it and then it all went crazy. I have turned my laptop off and not sure what to do. Have I lost all my files and folders? Can I get any off them back? Are they still on my external drive hidden? Can anyone please help.

bee on June 28, 2011:

Thanks a lot. :)

Aelita on June 27, 2011:

YAY! I looked up what the other one was and i'm DEFINITLY going to start running regular computer scans from now on! Thank you very much for your help- you helped me save some really important work[and money i dont have]

charlemont (author) from Lithuania on June 27, 2011:

Oh well, I'm happy you kicked that nasty out ;-)

Yes, Trojan is exactly what was causing scary scanner pop-ups. Now it's gone!

Aelita on June 27, 2011:

yes i used SUPERAntiSpyware and i scanned the C: drive, it found alot of Cookies[i'm not surprised about that] and something called "Browser Hijacker. Tubby" and something else that said actually "Trojan" in it, so i'm guessing that was the Trojan[quite obvious....i thought it'd be named something else]. it then removed them and i am using my computer normally[not safe mode. "normal" mode i guess?]

charlemont (author) from Lithuania on June 27, 2011:

Aelita, did you scan your computer hard drive with SUPERAntiSpyware? Right-click on its icon in the tray area (near system clock), choose "Scan for Spyware, Adware, Malware..." You have to scan drive C:\

Working in Safe Mode is not quite comfortable due to lower screen resolution and certain applications being unable to launch, so it is mainly used for 'techical' stuff like virus removal.

Aelita on June 27, 2011:

It went well :D so far i haven't had any annoying "scans" out of safe mode[though i was scared when i got a reminder from Nortan Antivirus that it had expired haha] thank you VERY much for your help!

charlemont (author) from Lithuania on June 27, 2011:

Aelita, it's up to you how to grab a copy of SUPERAntiSpyware, download it directly from the web to your desktop if you can. Install the program. During installation it will ask for a permission to download updates (there's a tick box or something like that).

I have a hub on SUPERAntiSpyware with plenty of images so you may want to have a look:

Once you've done scanning, let us know how it went ;-)

While you're in Safe Mode, that 'fake scanner' thingy is inactive and harmless, easy to get rid of.

Aelita on June 27, 2011:

I have my computer in safe mode(and it does look a little odd but at least im not getting an annoying pop-up scan!) Should i download it to my flashdrive first or directly to the computer? I'm not sure if it'll work because it's in safe mode(don't know how big of a differnece that would make)


charlemont (author) from Lithuania on June 27, 2011:

Hi Aelita, you're very clever I must say when it comes to computers! Really, many people start messing things up trying to install that and that, only to end with non-bootable Windows.

In hibernation mode, nothing is happening. However, I suggest that you should shut down your laptop (so you have to open the lid, press the power button, and then use Windows shut down option).

Then, download SUPERAntiSpyware to a USB flash drive.

Turn on laptop, keep hitting F8 key insanely (well, sort of ;-) until Windows Boot Menu appears. From the list of options, choose Safe Mode with Networking using cursor keys. Hit Enter. Log on to desktop (it'll look a bit weird, that's normal). Plug in your USB flash drive (with SUPERAntiSpyware stored on it), double-click the program executable, install. The software should update itself using your network/Internet connection. Once updated, run a full scan.

Aelita on June 26, 2011:


I'm using my iPod for this so sorry about any typos. I have a trojan on my laptop, it's one of the ones that run a "scan" and scam you into byeing the "full version" I didn't download or pay anything when I saw this, i just closed my computer, which puts it in hibernation mode, and came here on my itouch.

Is Trojan still working it's way around my computer in hibernation mode? Would downloading the recimended scanner/ antivirus( the ones in this articile) on a flashdrive work? Also, I know this may seem silly, but how do I put my computer in safe mode? I'mnot very good with computers so I have no idea what I'm doing. I have windows x-something . I think it's called XP?

Thank you

charlemont (author) from Lithuania on June 20, 2011:

Hello ParisSteph, it looks like the trouble you're dealing with is called 'spyware protect 2009' or something similar. It is very good that you didn't start messing with the infection and just shut down the laptop.

I assume that you're running either Windows 7 or Vista on your laptop. If so, please use your netbook to download the following tool (HiJackThis version 2.0.4):

Get the executable .exe file. Put it on a USB flash drive.

Then turn on your infected laptop, and keep hitting F8 key immediately. You should be brought to Windows boot menu. If a normal boot goes on, shut down using the button or Reset. Once in the Boot Menu, highlight Safe Mode with Networking and hit Enter.

When you log on, copy HiJackThis executable file from USB flash drive onto desktop. Right-click on it to run as administrator. Select 'Scan Only' option. After a scan is complete, a Notepad window will pop-up with a lengthy log. Copy-paste everything in that window into a new file on USB flash drive.

On top of this page you'll see a link "contact charlemont". Drop a short message via it (just tell that it's from ParisSteph). Copy-paste the log-file created by HiJackThis as well. I'll get back to you soon.

ParisSteph on June 20, 2011:

PLEASE HELP!!! I was downloading a TV show this morning and I think I must have picked up a Trojan infection. I got a pop-up that said "TCrdMain.exe can not start

File TCrdMain.exe is infected by W32/Blaster.worm. Please activate Malware Protection to protect your computer." An icon for Malware Protection appeared on my desktop. I did not click on it and did not activate the Malware Protection, but the pop-up will not disappear.

I then got another pop-up accompanied by an awful noise that said "Firewall Warning

Hidden file transfer has detected a leak of your files through the internet. We strongly recommend that you block the attack immediately", along with an IP address and my computer name.

I cannot access the internet or any of my programs from the laptop (I am currently on my annoying little netbook). I have McAfee Total Protection and ran a full scan, but it didn't find any viruses. I tried to get help from McAfee, but they say that they cannot help me unless I can get internet access back and that I should contact my internet provider to reestablish my internet connection. I downloaded the Malwarebyte and SUPER antispyware programs onto an external flashdrive and then tried to run them on the infected laptop, but they won't launch. What should I do??? Thank you for any help you can provide!

charlemont (author) from Lithuania on June 03, 2011:

Hi Lee, sorry to hear you picked up that nasty.

What is your laptop model and Windows version?

Sometimes laptop owners prefer to perform factory restore using a hidden partition image (provided by the vendor) rather than try to remove infection. If your important data is backed up on external storage, then it might be a good idea. But if you have a lot of software installed and configured then doing factory restore isn't the best option.

Lee on June 02, 2011:

Hey there, i jus got this vicious fake Security Shield malware in my laptop. It wont allow me to do anything, i cant open any of my files and i keep getting pop ups. Please help.. I tried downloading Malwarebyte but Security Shield (the malware) wont allow me to complete Malwarebyte's installation or anything else for that matter. I just cant get it out! =(

ianchan1985 on May 26, 2011:

the virus is very annoying in your system, it could damage your whole system sometimes, and one time I got virus infected, then some of my internet security program corrput then I have no way to get them out. Thanks for Malwarebytes, it help me clean the virus.

But I also think an uninstaller called Best Unisntall Tool, it helps me get rid of the corrupt programs.

charlemont (author) from Lithuania on May 22, 2011:

Hi Melanie,

please drop me an email at the link on top of the page (contact charlemont), I'll get back to you. Include details of your computer (Windows version, service pack level, 32-bit or 64-bit).

Melanie on May 22, 2011:

Hello charlemont, I was hoping you may be able to help me. I wanted to watch a movie online about 2 days ago and I used a website recommended to me by my techie brother. I had used this website ( before and had no problems. However, as soon as I clicked on the link to the movie, my AVG popped up and said that my computer was in trouble. I followed the steps it told me to take, and everything seemed okay. But as soon as I opened Firefox 4, I noticed my default browser had been changed to Mp3Tube:powered by yahoo, and I had a new toolbar as well. I went and installed Super anti spyware and another safe anti spyware program, ran it, and removed everything that showed up. It still didn't work. I ran a system restore and it did not work. I was browsing the internet for anything to help and I found a spyware doctor thing and ran a scan, it said I had multiple "Zango" spyware programs and two trojan viruses. It would not let me remove them unless I paid, but I don't have enough money to get the program. I've run my free version of AVG multiple times and it says I'm clean. I know for a fact I'm not, though. Is there anything you suggest to do?

charlemont (author) from Lithuania on April 28, 2011:

Manny, drop a message via this link:

Include information about your Windows version (XP, Vista, 7 etc.) and if it is 32-bit/64-bit.

Manny on April 28, 2011:

I lost all my desktop icons and everything else....some voice came on with skype saying its an emergency. What can i do to fix this.

charlemont (author) from Lithuania on April 27, 2011:

Ed, both Malwarebyte's and SUPERAntiSpyware are free removers. You don't have to purchase licenses to use software for removing infections. Updates are available, too, and there's no time limit to using programs. Paid versions just come with more features, that's it.

Ed on April 27, 2011:

I can't find the free Trojan removal? Where is the free you're talking about? SHIT........ plunder

charlemont (author) from Lithuania on April 18, 2011:

Dale thanks for stopping by!

Resetting to factory defaults usually works, but it is a drastic measure not suitable for everyone because it involves reinstalling all and every program not supplied by the PC maker. Backing up all data prior to recovery is crucial, too.

It's nice of you to let us know how you handled the problem.

Dale on April 18, 2011:

Thanks for your help i didn't need to burn that disk i'n the end as i revolted my laptop to factory settings by pressing alt and f10 at the same time on my acer laptop when the acer logo appears as you turn it on so if anyone else has an acer apparently this is how you boot your laptop back to factory settings and it doesn't take very long so spot on! Be aware though if you had to install vista or office from a disc you will have to redo this step as mine was already on the laptop when bought. I don't know if this trick works with anything other than acer laptops but maybe it's worth giving it a go?

charlemont (author) from Lithuania on April 18, 2011:

nomin1991 I assume you can still log on normally since you provided virus name (most probably it's been identified by your current antivirus program).

Download DrWeb CureIt:

and run it. When the scan is complete, select all detected entries and choose 'Cure' or 'Delete'.

nomin1991 on April 17, 2011:

Hi ,this is the virus name trojandownloader:Win32/Karagany.A my safe mode doesn't work

Related Articles