1

So I was trying to download an arcade game, everything seemed legit and I guess I was too excited to play it I started running it - only after clicking it I decided to run a scan on both Avira and Malwarebytes. As it was running Malwarebytes picked up a Trojan.Dropper, the game itself works but I deleted it promptly after quarantining the malicious file.

Now reading about droppers says they tend to alter your registry keys and create hidden files. In fact, Avira sent a prompt saying something just tried to edit my registry. I have no idea how to look for those to ensure my system is clean. How should I go about that? I've done a full system scan on both the software.

I've used a registry scanner and scanned for changes in the registry within 1 min before/after the item was quarantined which came up to about 101 entries, would it be best to put that into a pastebin to see if anything could have been malicious?

Thanks

  • 2
    If you don't trust your system, simply reformat. – Will Sep 19 '17 at 18:49
1

A third option (which imho is a bit better than just using the regular scan but obviously not as safe as a complete reinstall) would be to use a (or even better multiple) rescue disc that many of the antivirus companies offer (like this <- haven't tried that particular one, just the first one google threw at me).

These allow to scan the system when it is not running which makes it a bit harder for the malware to hide. If you happen to be from germany you could also give desinfec't a shot. It's not free but it's a rescue disc that uses multiple engines to scan you pc (amongst other things) and quite a handy tool.

  • Ooh, that's a good idea. I keep forgetting that these utilities exist. You can also use Linux Live CDs and then use an antivirus solution from there, such as clamav. It's free, and you can do a lot of other stuff, such as edit the Windows registry hive and manage disk partitions. – MoonRunestar Sep 22 '17 at 14:23
0

Honestly, you have two options here:

  • Hope that those scans picked up everything and continue using the computer.
  • Do what @Will suggested and completely reinstall Windows from a fresh installation.

Personally, I would do a reinstall, as you don't know if Malwarebytes and Avira picked up every part of the dropper Trojan. If you don't want to do a complete reinstall, but want to attempt to remove the traces of the Trojan, you could try using Windows' System Restore feature, if there is a restore point available before you downloaded the game.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.