Trojan horse "Generic.15.apnz" impossible to get rid of?

Question

I have a trojan horse infection that lives in memory and seems to be impossible to get rid of. I've tried a few antivirus products (Norton, Windows Essentials and AVG Free) all to no avail and I've recently tried a few bootable antivirus solutions.

• Kaspersky Rescue Disk 2008: failed - it wouldn't even load the UI, is there a newer one out there?
• F Secure Rescue Disk: updates and scanner ran, found 10 infections, stated it was going to delete or repair them, but didn't get rid of them.
• Avira: found a lot of infections but froze when I tried to interact with the UI after the scan.

Every time I run these I'll boot Windows afterwards and run AVG - it still finds Trojan Horse Generic.15.apnz (in Services.exe) and Trojan Horse Generic.16.ARSU (in svchost.exe)

Is anyone familiar with a virus like this? Is there a working solution for removing it?

Answer 1

Backup your important files, format your hard drive and reïnstall your OS.

I think this is probably the safest way to get rid of the trojan horse; the longer it takes the more damage you will probably experience.

Answer 2

I have not tried it (I don't have that virus), but the following link shows steps to remove and at least one user that got rid of it:

http://forums.majorgeeks.com/showthread.php?t=212351

Answer 3

Back up your data, format the machine and reinstall from trusted backups/restore media.

Then virus scan your data and do not allow anything on that backup to execute before putting it back on the now clean machine.

That's generally enough for a home system.

Answer 4

I know this is old now, but it came up again on the active view and I had to add my two cents:

Penny #1 (first mistake): This isn't a forum. It's a question and answer site. The difference is subtle but important.

Penny #2 (second mistake): Never try to clean up any confirmed malware infection.

These days, one virus will often download other, sneakier viruses. You may clean up the original problem and still have another, more dangerous miscreant lurking about. Once upon a time, just removing obvious symptoms was enough; the odds of something more dangerous surviving your cleanup were low enough and the risk you took on for this gamble was low. These days, both terms of that equation have changed. Modern rootkits make a virus more likely to survive a general clean up, and things like online banking and purchasing make your risk much greater. The best thing to do now is save your data, reformat your drive, and then reinstall everything. Don't even try to clean up a confirmed infection.

That said, if you must make the attempt, the way to do it is with a clean operating system. Boot from a cd or other external media, mount your hard drive from there, and use an antivirus tool included as part of that external boot device to clean your system.

Answer 5

Symantec Endpoint Protection, Microsoft Malicious Software Removal Tool, Malwarebytes and Spybot. Load them all up at the same time and you should kill it.

If it doesn't, reformat.