Trovi keeps on coming back after multiple cleans

[alfa156melb]

Hi there,

 

Having used Malwarebytes and a number of other scanners to clean my computer, the Trovi virus keeps on coming back on reboot.

 

I would really appreciate some help on removing this please!!!

 

Also, I have not been able to log into my companies sharepoint intranet over the past couple of days.. would this have anything to do with it?

 

Thanks in advance!

 

 

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
Can you explain how it keeps coming back? Thanks!

[alfa156melb]

Hi thanks for helping

 

Well, each time i do a Malwarebytes scan, it picks it up

[alfa156melb]

Sorry I pressed post by accident.. can't find an edit button.. 

 

start again..

 

Hi thanks for helping 

 

Well, each time i do a Malwarebytes scan, it picks it up in teh Chrome Preferences file.

 

I quarantine it and it clears.. then after reboot.. there it is again in the next scan...

[alfa156melb]

Log form Malwarebytes...

 

Malwarebytes Anti-Malware

www.malwarebytes.org

 

Scan Date: 24/09/2014

Scan Time: 8:17:58 PM

Logfile: 

Administrator: Yes

 

Version: 2.00.2.1012

Malware Database: v2014.09.24.05

Rootkit Database: v2014.09.19.01

License: Premium

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Enabled

 

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: davidh

 

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 390698

Time Elapsed: 10 min, 1 sec

 

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Warn

PUM: Enabled

 

Processes: 0

(No malicious items detected)

 

Modules: 0

(No malicious items detected)

 

Registry Keys: 0

(No malicious items detected)

 

Registry Values: 0

(No malicious items detected)

 

Registry Data: 0

(No malicious items detected)

 

Folders: 0

(No malicious items detected)

 

Files: 1

PUP.Optional.Trovi.A, C:\Users\davidh\AppData\Local\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: (   "homepage": "http://www.trovi.com/?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&ISID=M05D71F3D-A3FF-4588-A85D-AD23A3D20F16&SearchSource=55&CUI=&UM=5&UP=SP94AA79D4-4018-4E7F-A16C-C75F9DB2DEA0&SSPV=TBannersC_sp_ch",), ,[265f24cb81fa50e6912f95a937ce6c94]

 

Physical Sectors: 0

(No malicious items detected)

 

 

(end)

[TwinHeadedEagle]

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[alfa156melb]

As requested...

Addition.txt

FRST.txt

[AdvancedSetup]

This topic will now be closed due to evidence of cracked or pirated software on this system.

Piracy Policy