Dangerous Trojan Removal Guide
Do you know what Dangerous Trojan is?
DESCRIPTION
Dangerous Trojan is a new error message similar to Unknown Trojan which we posted a few months ago. We have identified the Dangerous Trojan message as being related to the IEDefender group. Dangerous Trojan pops up messages in an attempt to get computer users to download and install Files Secure which is a dangerous rogue application.
Do you ever get the following message?
System Error!
Your system was infected by dangerous Trojan.
Note: Your critical files can be lost!
Click OK to download antimalware application to clean your system! (Recommended)
The above message is what Dangerous Trojan will prompt on your computer if you are infected. It is recommended that users do not click on this message, it may redirect you to a malicious site to download rogue software. We have discovered that Dangerous Trojan may change Google and Yahoo search results to display fake pornographic youtube video.
In non-techie terms: There is no doubt that Dangerous Trojan is properly named because it is actually a Dangerous Trojan infection. Dangerous Trojan should be removed as soon as possible if you are infected or you run the risk of further damaging your system. Do not under any circumstances purchase or download any software that is related to Dangerous Trojan or it’s popup messages.
Dangerous Trojan Automatic Removal Instructions
This automatic removal method is for non-techie computer users. If you’re too lazy to learn about spyware removal or how to access sensitive files in your computer, then this is the method for you.
Before you start: Print or bookmark these instructions because you’ll have to reboot into Safe Mode. Also back up your computer in case you make a mistake.
- Download and save SmitFraudFix to your desktop.
- Restart your computer in Safe Mode (how to do safe mode). Once the
desktop appears, double click on the SmitfraudFix.exe on your desktop. - After the credits screen, you’ll see a menu. Select the option number 2, which is ‘Clean (safe mode recommended)’, and then
press Enter to delete infect files. - SmitFraudFix will begin cleaning your computer and take a series of cleanup processes. When the process is over, it will automatically begin the Disk Cleanup program.
- Once the Disk Cleanup program is complete, you will be prompted with the message ‘Registry cleaning - Do you want to clean the registry’. Answer Y (Yes) and hit Enter. Reboot your computer.
- SmitFraudFix will now check if wininet.dll is infected. SmitFraudFix will ask you whether to replace the infected file (if there’s any) ‘Replace infected
file?’ Answer by typing Y (Yes) and hit Enter. - Reboot your computer to complete the cleaning process.
- After reboot, a Notepad screen may appear containing a log of all the files
removed from your computer. If it doesn’t appear, a file will be created called
rapport.txt in the root of your drive, (Local Disk C:). - Restart your computer in Safe Mode (how to do safe mode).
- Go to C:\Windows\Temp, click Edit, click Select All, press DELETE, and then
click Yes to confirm that you want all the items to go to the Recycle Bin. - Go to C:\Documents and Settings\[LISTED USER]\Local Settings\Temp, click Edit, click Select All, press DELETE, and then click Yes to confirm that
you want all the items to go to the Recycle Bin. - Reboot your computer back to normal mode. Go to Windows Update and download all critical updates.
Dangerous Trojan Manual Removal Instructions
This manual removal method is for techie computer users. Dangerous Trojan manual removal may be difficult and time consuming to remove. There’s no guarantee that Dangerous Trojan will be removed completely. So read the Dangerous Trojan removal steps carefully and good luck.
Before you start: Close all programs and Internet browsers. Also back up your computer in case you make a mistake and your computer stops working.
- Uninstall Dangerous Trojan Program
Click on Start > Settings > Control Panel > Double-click on Add/Remove Programs. Search for and uninstall Dangerous Trojan if found. - To Unregister Dangerous Trojan DLLs (view DLL removal steps)
Search and unregister these Dangerous Trojan DLLs:
ttaqdcwmaoxzw.dll
duserf.dll
oggview32.dll
byxww.dll
wfcynbmx.dll
hggdbab.dll
poswin.dll
tuvtr.dll
D3DCompiler_3.dll
dbmsrpcnw.dll
toprates.dll
ssqpp.dll
sstqr.dll
ddcyvtt.dll
avicap3.dll
efcdcbx.dll
sprt_ads.dll
pmkhi.dll
mljjh.dll
ezzhjmt.dll
browsew.dll
ctl3d3.dll
xmljacodec.dll
domnftwqpd.dll
turbosearchsite.dll
To locate the Dangerous Trojan DLL path, go to Start > Search > All Files or Folders. Type Dangerous Trojan and in the Look in: select either My Computer or Local Hard Drives. Click the Search button.
Once you have the Dangerous Trojan DLL path, go to Start and then click on Run. In the Run command box, type cmd, and then click on OK.
To locate the exact DLL path, type cd in order to change the current directory. To display the contents of the directory, use the dir command. To remove the DLL file type regsvr32 /u FILENAME.dll (FILENAME is the name of the file that you want to unregister). - To unregister Dangerous Trojan registry keys (view registry keys removal steps)
Go to Start > Run > type regedit > press OK.
Edit the value (on the right pane) by right-clicking on it and selecting the Modify option. Select the Delete option.
Search and delete these Dangerous Trojan registry keys: - If your homepage has been changed, go to Start > Control Panel > Internet Options > click on the General > click Use Default under Home Page. Add the your desired default homepage, then click Apply > click OK. Open a new web browser to check that you have your desired default homepage.
- Remove Dangerous Trojan Directories.
To find Dangerous Trojan directories, go to Start > My Computer > Local Disk (C:) > Program Files > Show the contents of this folder.Right-click on the Dangerous Trojan folder and select Delete.
A message will appear saying ‘Are you sure you want to remove the folder Dangerous Trojan and move all its contents to the Recycle Bin?’, click Yes.
Another message will appear saying ‘Renaming, moving or deleting Dangerous Trojan could make some programs not work. Are you sure you want to do this?’, click Yes. - To remove Dangerous Trojan icons on your Desktop, drag and drop them to the Recycle Bin.
You’ve completed the Dangerous Trojan manual removal instructions!
I hope this article has helped you solve your Dangerous Trojan problems. If you want to contribute to this article, post your comment below.
Disclaimer: This article is for educational purposes. By using this information you agree to be bound by the disclaimer. There’s no guarantee that Dangerous Trojan will be completely removed from your computer. Seek professional help if your computer continues to experience problems.
Did You Find this Article Helpful?
Subscribe to Spyware Techie for more!
Or get latest articles to your via email:
great job done. it worked
Thank you.
I didn’t have safe search on in google. Clicked something by accident ended up on that icky site and was infected. Bing Bang Boom! Sheesh. First one in almost three years!
The removal tool worked like a charm!
A note to those looking for help via google, even tho the trojan hijacks the hyperlink you can still cut and paste the url from the listing.
cez
Hey,
So I had a very similar thing occur to me over the last few days, and have finally gotten rid of it. Assumably the above works fine (from the comments posted) but for those who were in my shoes, with lovely “dangerous trogan” messages trying to download IEAV.exe (or something around those lines), here is what I did:
1. Tracked events in Windows Defender (of all things) and found the following:
—————————
Description:
This program has potentially unwanted behavior.
Advice:
Permit this detected item only if you trust the program or the software publisher.
Resources:
clsid:
HKLM\SOFTWARE\CLASSES\CLSID\{50AB4474-F8B5-4F66-BAC5-4251E765B827}
regkey:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50AB4474-F8B5-4F66-BAC5-4251E765B827}
regkey:
HKLM\SOFTWARE\CLASSES\TYPELIB\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0
regkey:
HKLM\SOFTWARE\CLASSES\CLSID\{50AB4474-F8B5-4F66-BAC5-4251E765B827}
bho:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50AB4474-F8B5-4F66-BAC5-4251E765B827}
typelibversion:
HKLM\SOFTWARE\CLASSES\TYPELIB\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0
file:
C:\WINDOWS\tupost32.dll
————————————–
2. Now I am not sure if the registry info here is common for all cases, but i proceeded to open RegEdit (Start Menu –> run –> Regedit)
3. Find the keys above in the registry (HKLM = HKey_Local_Machine) and delete them.
4. Tupost32.dll is still in my windows folder at this stage as I am unsure of its function, however the popup warning messages have stopped.
This was done after numerous software scans which didnt seam to solve the problem.
I hope this helps some people and makes a bit of sense. I am by no means a computer wizz, so am unaware if I have done the ‘right’ thing, but have undoubtedly managed to solve the problem at hand.