mlclm Posted September 6, 2009 Share Posted September 6, 2009 A couple days ago, I was helping someone out and downloaded a keygen for them. Now, every time I turn on my computer, the keygen pops up and Windows defender gives me a warning about "Backdoor:Win32/Rbot.gen!G". I don't know what to do. :c Link to comment Share on other sites More sharing options...
OldJoe Posted September 6, 2009 Share Posted September 6, 2009 Your AV can't remove it? And what's your AV? J'adore aussi le sexe et les snuff moviesJe trouve que ce sont des purs moments de vieJe ne me reconnais plus dans les gensJe suis juste un cas désespérantEt comme personne ne viendra me réclamerJe terminerai comme un objet retrouvé Link to comment Share on other sites More sharing options...
mlclm Posted September 6, 2009 Author Share Posted September 6, 2009 Avira. Link to comment Share on other sites More sharing options...
OldJoe Posted September 6, 2009 Share Posted September 6, 2009 Have you tried running Avira and see if it can delete it? Otherwise what i found was a solution at Sophos, but that includes going into the registry ( http://www.sophos.com/security/analyses ... botwv.html ). If you can, wait for someone else to give you a better reply. J'adore aussi le sexe et les snuff moviesJe trouve que ce sont des purs moments de vieJe ne me reconnais plus dans les gensJe suis juste un cas désespérantEt comme personne ne viendra me réclamerJe terminerai comme un objet retrouvé Link to comment Share on other sites More sharing options...
mlclm Posted September 6, 2009 Author Share Posted September 6, 2009 I've had Avira run a scan, but it doesn't pick anything up. Thanks for the link, it'll be helpful if no one else has any advice, but I'll wait a little bit for more replies. Link to comment Share on other sites More sharing options...
Jard_Y_Dooku Posted September 7, 2009 Share Posted September 7, 2009 The solution to your problem. [*:1gc7avnh]Make a virtual machine [*:1gc7avnh]Install your OS on to the virtual machine [*:1gc7avnh]Snapshot the hard drive [*:1gc7avnh]Download Trojans on to your virtual machine [*:1gc7avnh]Snapshot the hard drive [*:1gc7avnh]Compare snapshots [*:1gc7avnh]Using information, remove Trojan from actual machine [*:1gc7avnh]Never download shifty programs on to your actual machine again - that is what virtual machines are for - installing viruses and having nothing happen Of course that is not guaranteed to work (the Trojan may perform different actions depending on the date and time or your system's configuration), but has a very high chance of. Never trust anyone. You are always alone, and betrayal is inevitable.Nothing is safe from the jaws of the decompiler. Link to comment Share on other sites More sharing options...
mlclm Posted September 8, 2009 Author Share Posted September 8, 2009 I don't know how to do that Jard. Link to comment Share on other sites More sharing options...
Looce Posted September 8, 2009 Share Posted September 8, 2009 Since Sunbelt Labs has an entry on the named Trojan, and its advice is to use Remove, Sunbelt Home and Home Office antivirus might be able to remove it. Or look for "Backdoor:Win32/Rbot.gen!G removal tool" on Google :) Jard, while your instructions are top-notch for those who want to submit infection samples to an antivirus lab (i.e. IT security experts), I don't expect average users to be able to do this. :| Link to comment Share on other sites More sharing options...
mlclm Posted September 8, 2009 Author Share Posted September 8, 2009 Since Sunbelt Labs has an entry on the named Trojan, and its advice is to use Remove, Sunbelt Home and Home Office antivirus might be able to remove it. Or look for "Backdoor:Win32/Rbot.gen!G removal tool" on Google :) Jard, while your instructions are top-notch for those who want to submit infection samples to an antivirus lab (i.e. IT security experts), I don't expect average users to be able to do this. :| Thanks for that link and I didn't even think about just searching on Google lol. #-o Link to comment Share on other sites More sharing options...
Sam Posted September 8, 2009 Share Posted September 8, 2009 Keygens will always be classified on AV's as trojans/viruses because they generate code - at least most of them time, it depends where you download stuff from. 2257AD.TUMBLR.COM Link to comment Share on other sites More sharing options...
mlclm Posted September 9, 2009 Author Share Posted September 9, 2009 Keygens will always be classified on AV's as trojans/viruses because they generate code - at least most of them time, it depends where you download stuff from. I used to always scan my files after I downloaded them, but I've pretty much stopped that since I got a Demonoid invite. Guess I shouldn't have. Since Sunbelt Labs has an entry on the named Trojan, and its advice is to use Remove, Sunbelt Home and Home Office antivirus might be able to remove it. Or look for "Backdoor:Win32/Rbot.gen!G removal tool" on Google :) Jard, while your instructions are top-notch for those who want to submit infection samples to an antivirus lab (i.e. IT security experts), I don't expect average users to be able to do this. :| The Sunbelt AV is only a trial, so I ran a search and there was a removal tool on Microsoft's website, but IE crashed while it was running. -.- I'm gonna try it again today in safe mode, but if it doesn't work I'll just download the trial. Link to comment Share on other sites More sharing options...
MageUK Posted September 9, 2009 Share Posted September 9, 2009 Keygens will always be classified on AV's as trojans/viruses because they generate code - at least most of them time, it depends where you download stuff from. They're actually generally classified as viruses because of the packers they use to contain themselves, which is similar to the same packing that some viruses use. It's because of the way they are contained, not because of their function. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now