Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I managed to catch a newish trojan that my Anti virus program wasn't able to detect.

I'm usually not that bad at technical stuff regarding computers but I really don't know what to do with this one anymore.

The trojan somehow managed to get my Windows to recover it every time I try to remove it by deleting it's exe (called some weird name located in Programs "asdza/saddasn.exe" (example only)). It also sets an entry in my autostart.

It starts a second explorer.exe and tries to connect to some server obviously trying to steal data. (glad I still have my firewall)

How can I get rid of this trojan, I really need help.

It is new and probably unrecognized by all major virus scanners.

share|improve this question
up vote 2 down vote accepted

First thing is to turn off system restore if it is on. Reboot and make sure it stayed off. Download the latest AV updates and run a full scan. You may need to do this in safe mode.

Grab some of the other tools such as Adaaware, Spybot search and destoy and MalwareBytes and do full scans. I would use all three. If you get the name of the malware, I can offer more specific direction




share|improve this answer
@hsdb, I'd download malwarebytes at least and run a full scan in Safe Mode. Also get HijackThis and remove suspicious things, and use it's advanced tools to remove evil files on reboot – Tyler Mar 12 '10 at 18:21
Do you think that this trojan is capable of actually modifying the explorer.exe or does it need to start itself up at every boot? Its goal was to keep itself in the registry autorun, I managed to get rid of it there, though. – hsdb Mar 12 '10 at 18:31
I think I've fixed it now. Browsed through the system restore backup files and replaced my current (possibly infected) explorer.exe with an old one. thanks for your help. – hsdb Mar 12 '10 at 18:51

You must log in to answer this question.