Banker Dropper And Downloader Trojan Horses
Aug 9, 2005
I have AVG free edition and it found 8 trojan horse viruses. Funny that the free program picked it up but my Zone Alarm Pro hasn't said a word.I can't cut and paste the paths bu one is C:program files/dell/R61444.exe and another isC:i386/CISVC.EXE, C:windows/$NtServicePackUninstall$cisvc.exe and several more It says they aren't healable and the source is a back up copy. Back up copy of what I do not know, I don't remember using a back up copy of anything. When I tried to put one it detected this morning in the vault it said if I did that it might cause something to become unstable.I did get another error message that said something about copies of something had been replaced with unauthenticated (I think) versions, and that something could be unstable (this was after AVG ran and said I had the viruses)and to insert the xp home edition disk. I did that and pretty much didn't know what to do after that so I took it out again.
View 7 Replies
ADVERTISEMENT
Apr 1, 2006
I have windows xp, i have avg antivirus and have run the tests in pc pitstop and done a regular search thru windows for the Trojan-Dropper.VBS.Inor.cz but can't locate it on my pc. My IE browser freezes everytime i go to a particular site and yet when i ask if anyone else has trouble with that site only a very few people say yes. The solution they give me is to download Mozilla and use it for that site. That doesn't protect me from the trojan completely infecting me does it? Can anyone tell me how to delete this trojan?
View 14 Replies
View Related
Dec 31, 2004
computer is effected by viruses 2 Trojan horse Dropper.Small.7.AR 1 Trojan horse Downloader.Agent.AS
View 3 Replies
View Related
Jan 8, 2007
Following my post saying i cannot change my wallpaper i have founr out that i have "Trojan-Downloader.Win32.Agent.uj" in stalled on my PC. I am unsure how to remove this. All i know is that it collects my personal data. Can someone please let me know how to remove this from my computer Below if my HJT log
View 3 Replies
View Related
Feb 15, 2008
I have this trojandownloader:win32/Zlob and i cant delete it?
View 7 Replies
View Related
Apr 15, 2006
Above name virus kept on re-appearing after being found and deleted by AVG Antivirus Free Edition.Path=C:Program Filess?curity, File Name= csrss.exe.Am using Windows XP Home Edition, SP2 Ver:5.1.2600 Build 2600. Internet Explorer 7 :Ver:7.0.5335.5 Beta 2.Please,can anyone advise me on how to erase,remove this virus completely and permanently from my computer.
View 10 Replies
View Related
Mar 31, 2005
i have a packard bell laptop which is about 2.5 years old and has windows XP home pre loaded i have got infected by 3 worm viruses w32 spybot worm ,w32spybot worm KHC and trojan dropper. in an attempt to remove i decided to use the pc restore disk to restore all setting to factory settings however i have now done this twice and still appear to have the viruses is this normal or am i doing something wrong.
View 6 Replies
View Related
Dec 17, 2004
trojan horse Downloader .Agent.5.P - is found in C:WINDOWSsystem32calsp.dll
AVG can't remove it
View 10 Replies
View Related
Jul 28, 2007
My daughters computer has something called "Trojan horse downloader Generic 4.ZQI, this has caused all sorts of problems with connecting onto the internet and has slowed the computer.
View 14 Replies
View Related
Jan 2, 2006
I have a Windows XP-based PC. AVG has detected the "Dropper.Inor" virus, but is unable to heal it. When I attempted to heal it, Should I try AVG's "Move to Vault" option or is there another course I should take?
View 6 Replies
View Related
Feb 11, 2005
I have of lot of trojans and can't seem to get rid of them I have ran Spy Bot,Avast,Ad-Aware,Stop Sign and found a 1 Trojan in reg32.exe =trojan.low zones
2 downloaded program files says: Trojan.downloader1097 3 System 32 sygate = Win32.HLLW.MyBot.based 4 Avenue Media Internet Optimizer Software Package = Possible spyware Application 5 Appropos Media People On Page Application = Possible Spyware
View 1 Replies
View Related
Jan 17, 2006
Ran into some virus fun,I think it is gone. I ran vundofix.exe; symantec's vundo fix; virtumonde fix from symantec; trojanhunter; hijackthis; winpatrol; spysweeper; (some in safe mode). And removed a BHO for winlogon.exe with the mljgd.dll. That doesn't exist anymore,
HijackThis Log.
j.
Logfile of HijackThis v1.99.1
Scan saved at 10:36:39 PM, on 1/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32spoolsv.exe
C:Program FilesJavaj2re1.4.2_03injusched.exe
C:windowssystemhpsysdrv.exe
C:HPKBDKBD.EXE
C:WINDOWSsystem32VTTimer.exe
C:WINDOWSAGRSMMSG.exe
C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
C:Program FilesHPHP Software UpdateHPWuSchd2.exe
C:WINDOWSsystem32hphmon03.exe
C:WINDOWSALCXMNTR.EXE
C:Program FilesMicrosoft AntiSpywaregcasServ.exe
C:Program FilesMcAfee.comVSOmcvsshld.exe
C:Program FilesMcAfee.comVSOoasclnt.exe
c:progra~1mcafee.comvsomcvsescn.exe
C:PROGRA~1mcafee.comagentmcagent.exe
C:PROGRA~1mcafee.commpsmscifapp.exe
C:Program FilesWebrootSpy SweeperSpySweeper.exe
C:Program FilesMessengermsmsgs.exe
C:WINDOWSsystem32ctfmon.exe
C:WINDOWSsystem32driversCDAC11BA.EXE
c:program filesmcafee.comagentmcdetect.exe
c:PROGRA~1mcafee.comvsomcshield.exe
c:progra~1mcafee.comvsomcvsftsn.exe
C:Program FilesMicrosoft AntiSpywaregcasDtServ.exe
c:PROGRA~1mcafee.comagentmctskshd.exe
C:Program FilesCommon FilesMicrosoft SharedVS7DEBUGMDM.EXE
C:WINDOWSsystem32svchost.exe
C:Program FilesWebrootSpy SweeperWRSSSDK.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesAdobeAcrobat 7.0ReaderAcroRd32.exe
C:Program FilesCommon FilesRealUpdate_OB
ealsched.exe
C:Program FilesWindows Media Playerwmplayer.exe
C:Documents and SettingsHP_OwnerDesktopprocexp.exe
C:Program FilesJavaj2re1.4.2_03injucheck.exe
C:PROGRA~1McAfee.comPERSON~1MpfAgent.exe
C:Program FilesMcAfee.comPersonal FirewallMpfTray.exe
C:PROGRA~1McAfee.comPERSON~1MpfService.exe
C:WINDOWSsystem32msiexec.exe
C:Program FilesInternet ExplorerIEXPLORE.EXE
C:Documents and SettingsHP_OwnerDesktophijackthisHijackThis.exe
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Page = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ion&pf=desktop
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:program filesmcafee.commpsmcbrhlpr.dll
O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - c:program filesmcafee.commpspopupkiller.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:progra~1mcafee.comvsomcvsshl.dll
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_06injusched.exe
O4 - HKLM..Run: [hpsysdrv] c:windowssystemhpsysdrv.exe
O4 - HKLM..Run: [HPHUPD06] c:Program FilesHP{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}hphupd06.exe
O4 - HKLM..Run: [KBD] C:HPKBDKBD.EXE
O4 - HKLM..Run: [VTTimer] VTTimer.exe
O4 - HKLM..Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM..Run: [Reminder] "C:WindowsCreatorRemind_XP.exe"
O4 - HKLM..Run: [HPDJ Taskbar Utility] C:WINDOWSsystem32spooldriversw32x863hpztsb04.exe
O4 - HKLM..Run: [HP Software Update] "C:Program FilesHPHP Software UpdateHPWuSchd2.exe"
O4 - HKLM..Run: [HPHmon03] C:WINDOWSsystem32hphmon03.exe
O4 - HKLM..Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB
ealsched.exe" -osboot
O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime
O4 - HKLM..Run: [gcasServ] "C:Program FilesMicrosoft AntiSpywaregcasServ.exe"
O4 - HKLM..Run: [VSOCheckTask] "C:PROGRA~1McAfee.comVSOmcmnhdlr.exe" /checktask
O4 - HKLM..Run: [VirusScan Online] C:Program FilesMcAfee.comVSOmcvsshld.exe
O4 - HKLM..Run: [OASClnt] C:Program FilesMcAfee.comVSOoasclnt.exe
O4 - HKLM..Run: [MCAgentExe] c:PROGRA~1mcafee.comagentmcagent.exe
O4 - HKLM..Run: [MCUpdateExe] c:PROGRA~1mcafee.comagentmcupdate.exe
O4 - HKLM..Run: [MPFExe] C:PROGRA~1McAfee.comPERSON~1MpfTray.exe
O4 - HKLM..Run: [MPSExe] c:PROGRA~1mcafee.commpsmscifapp.exe /embedding
O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k
O4 - HKLM..Run: [SpySweeper] "C:Program FilesWebrootSpy SweeperSpySweeper.exe" /startintray
O4 - HKLM..Run: [THGuard] C:Program FilesTrojanHunter 4.2THGuard.exe
O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Reader
eader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:Program FilesHPDigital Imaginginhpqtra08.exe
O8 - Extra context menu item: Add To HP Organize... - C:PROGRA~1HEWLET~1HPORGA~1incore.hp.mainSendTo.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MI1933~1OFFICE11EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06in
pjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:Program FilesJavajre1.5.0_06in
pjpi150_06.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:Program FilesHelloPicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:Program FilesHelloPicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1097093077531
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/inst...l/pinstall.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/sj/en/check/qdiagh.cab?322
O20 - Winlogon Notify: igfxcui - C:WINDOWSSYSTEM32igfxsrvc.dll
O20 - Winlogon Notify: WRNotifier - C:WINDOWSSYSTEM32WRLogonNTF.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - C:WINDOWSsystem32driversCDAC11BA.EXE
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:Program FilesiPodiniPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:program filesmcafee.comagentmcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:PROGRA~1mcafee.comvsomcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:PROGRA~1mcafee.comagentmctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:PROGRA~1McAfee.comAgentmcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:PROGRA~1McAfee.comPERSON~1MpfService.exe
O23 - Service: Pml Driver - HP - C:WINDOWSsystem32HPHipm09.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:Program FilesWebrootSpy SweeperWRSSSDK.exe
View 6 Replies
View Related
Nov 2, 2007
ive tried getting rid of the Downloader.MisleadApp virus through Norton Antivirus and it wouldn't delete so i followed the directions it suggested by deleting it through safe mode but that also didn't work what else should i do?
View 7 Replies
View Related
Jun 12, 2005
I was able to take it out with BART PE which I had to put into the cd drive and it would boot from the disk and it found the Trojan in the Windows Operating Boot File but when I deleated it I could not boot up after that! I tried to boot from safe mode and it would freeze after I would enter my password and then enter.
I had to restore the computer from a back up file I had but it is currently restored with the TROJAN AGAIN!
I am running:
XP PRO w/SP2 / NT PLATFORM
5.1 (BUILD 2600.XPSP_SP2_GDR.050301-1519)
Workstation / NTFS / i386 /EXPLORER EXE
AMD PROCCESSOR
View 3 Replies
View Related
Feb 10, 2005
Recently i was looking for a file to download and i ended up in a German site [i think] and it something popped up so i press "ok" thinking it was the file i needed. Suddenly, norton popped up and it said that i have a trojan virus and aunable to repair. I forgot the address but it ended with "assistanthelper[1]" Im not sure though.
View 6 Replies
View Related
Jan 22, 2006
I've got the trojan.vundo virus. I have installed and run the vundo removal tool, and it shows me that it is gone-but when I restart my computer, Norton anti-virus finds it again (and again...and again).
View 14 Replies
View Related
Sep 8, 2007
PC is infected with this Trojan. I've downloaded xsoftspy and performed a full scan. It appears to remove the offending files but it still comes back.
When it does it tries to load up various internet sites telling me to download software.you advise running fixware. I've tried this and this is the result.
Username "MARK" - 08/09/2007 23:10:11 [Fixwareout edited 9/01/2007]
~~~~~ Prerun check
Successfully flushed the DNS Resolver Cache.
System was rebooted successfully.
~~~~~ Postrun check
HKLMSOFTWARE~Winlogon "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....
~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SM1BG"="C:\WINDOWS\SM1BG.EXE"
"Motive SmartBridge"="C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe"
"USB Storage Toolbox"="C:\Program Files\USB Disk Win98 Driver\Res.EXE"
"C-Media Mixer"="Mixer.exe /startup"
"SPAMfighter Agent"=""C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60"
"Adobe Reader Speed Launcher"=""C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe""
"TkBellExe"=""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot"
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6172\SiteAdv.exe"
"QuickTime Task"=""C:\Program Files\QuickTime\qttask.exe" -atboottime"
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
"MSMSGS"=""C:\Program Files\Messenger\msmsgs.exe" /background"
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~
View 6 Replies
View Related
Feb 11, 2007
Recently, my laptop was attacked by a trojan called update.exe. i think i got it from an open network in a hotel. I have tried many things to try to get rid of it, ive ran all the spyware programs i have and ive gone into my hard drive and tried to delete it manually as well. nothing works to get rid of it. does anybody know how i could get rid of update.exe?
View 1 Replies
View Related
Oct 14, 2005
I am running windows XP and counterspy has picked up a FTP Attack Trojan. I quarantined then deleted it but it keeps coming back. I also tried a porgram called Swatit but that did not find anything wrong. My computer has started acting improperly.rejecting games etc.
View 11 Replies
View Related
Sep 29, 2010
I have a DLL in my windows/system32 folder. I have used a tool to see what processes are running and what they are associated with. It is asscoiated with explorer.exe as you can see that in the process checking tool. I have done some analysis on dlo1BC.dll and it appears it is virus, but I cant delete it, no matter what I try. When I shut down the conputer explorer wont shut down smoothly and I think this is because of the dlo1BC.dll associated with it in the processes.
View 7 Replies
View Related
Nov 2, 2007
I get this trojan today and i never get viruses usually but this one reaqlly is annoying!
Ive looked at all the other posts and ive tried using the vundo fix tool etc but it does not pick it up at all. Ive tried doing it in safe mode and ive tried unistalling java to see if it was involved with that but nothing has worked so far.
I have located the file in my system32 folder and its named xxyywtq.dll but theres no way it will let me delete it as it says it is being used by another program or person.
View 1 Replies
View Related
Dec 6, 2006
I have a problem with my PC. A few days ago I received a URL in MSN messenger that infected me with a trojan horse when I entered the site.
Since then, AVG antivirus has popped up every time I startup my computer and has told me "threat detected - trojan horse downloader." I proceed to heal the file, yet next time I start up the same thing happens. The file name is simply "installer.exe". Immediately after this, my internet explorer opens and opens "web.links4all.biz",which I believe re-infects me. Since then, I have worked with my PC for a few days, with the intention of coming on here and sorting out the problem when I get the chance, unfortunately, the problem has escalated.
During my usual practice, AVG popped up saying "threat detected" once again. This time, the problem was "Trojan horse flooder." I told it to heal the file, it said it was healed, but told me I had to restart my computer for the process to complete.I restarted my computer, but after the first windows loading screen, the system shuts off and automatically reboots, until it reaches this point where the same thing happens.
I've tried using safe mode, and nothing has changed, it still enters the cycle of restarting continually.
View 14 Replies
View Related
May 15, 2006
I have Windows xp. If I have a Trojan Horse on my pc, is it safe still to use it? or should I wait till I can get the TH off of here? What exactly will it do to my machine?
View 3 Replies
View Related
Dec 10, 2006
Recently my AVG has popped up saying that i have recieved a Trojan. Also the computer and internet seem to be alot slower and the computer wont actually turn it off, it will only go into standby.
View 4 Replies
View Related
Sep 2, 2009
The Anti Trojan software is available on net.Does anyone knows about it?Is it helpful in removing Trojan?
View 4 Replies
View Related
Jan 11, 2005
infected with trojan virus. What do I do?
View 10 Replies
View Related
May 23, 2006
i got a trojen virus on my computer just resently i have norton and avg but i would like to now what programs are good to have to to keep things safe.
View 2 Replies
View Related
Jan 20, 2006
found some trojans with mcafee.. not that experienced to remove them yet. so here s my hijack this log,
View 7 Replies
View Related
May 11, 2007
Norton has scaned the virus named 'Trojan.PSW.WorldOnline' but it can't be deleted.
View 3 Replies
View Related
Feb 13, 2010
I got 2 Trojans on both of my computers, both computers are ASUS (Custom built) running XP Home SP3, IE6 with Bose Speakers... AVG associates the sound driver with the trojans, which I don't understand... The first step would obviously be to delete the sound driver and install a new one, but I don't know of a TRUSTED site.
View 9 Replies
View Related
Sep 17, 2005
Does anybody know how to remove the trojan, requiembot? Norton does not even know what it is let alone provide a removal tool, unless of course, they know it by another name.
View 8 Replies
View Related
