Trovi virus - not sure what to do

[bikerboy]

Hello,

 

I bought a used computer on Amazon from EZCORP, and it was filled with viruses and malware, including the TROVI virus. I know, I know, bad idea. Anyway I'd like to try to clean up the computer before I return it.

 

I'm a new user to the Malwarebytes forums. I don't know how to use the forums properly, so please forgive me if I'm doing something wrong. I've checked both the "Malware Removal Guides and Self Help Guides" and the "Malware Removal Help," and I haven't seen my exact situation listed, so I'm posting a new topic. I also don't know what a "pinned" topic is, nor what difference is indicated by the lock icon, the round dot bullet icon, or the absence of any icon at all to the left of each topic. Please forgive my lack of knowledge.

 

Before I found this website and associated advice, I ran 4 full Malwarebytes scans, and a total of 2500 malicious objects were found and removed. At first, something on the computer wouldn't let me download Malwarebytes. Then something wouldn't let me run it. Then something wouldn't let it finish. Finally, after 4 full scans, I was able to restart the computer with the 2500 malicious objects removed, I think. Some small problems have gone away, but the TROVI virus is still present: the default search provider is still redirected to trovi.com.

 

A search for "TROVI" on this website resulted in several threads/topics with the same advice given. This advice is, in essence:

 

1. FRST

2. Malwarebytes

3. AdwCleaner

4. ESET

5. FRST again

 

Should I run each of these programs in this order, following the specific details of each step given in other topics on the TROVI virus? Should I post the appropriate logfiles here after each step?

 

Malwarebytes posters who have helped in the past on this topic are deeprybka and TwinHeadedEagle. Please forgive me if this is inappropriate to list.

 

Thanks for any help. I will donate something in the end. I believe in paying for good advice.

 

Norm

Sequim, Washington

[TwinHeadedEagle]

Hello,
    
     
    
Before we start please read and note the following:

• Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
• Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

Scan with ZOEK
 
Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
• Post its content into your next reply.

[bikerboy]

Thanks for your reply. My computer spontaneously restarted once before I tried downloading Zoek. Upon restarting a message window stated the problem was a "Blue Screen." No idea what that means. Now my computer is spontaneously restarting each time I try downloading Zoek. I don't know what to do at this point.

[TwinHeadedEagle]

Is your Antivirus disabled before downloading Zoek?

[bikerboy]

Thanks for your reply. Sorry for me delay in responding to you. After several tries, the computer would only restart in safe mode without networking, so I couldn't even attempt to download Zoek. I returned the computer to EZCorp. It was a used computer they sold to me through Amazon as "Tested and works great." They either lied or were incompetent.

 

This thread can be closed now. Thanks again for your help.

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.