system
August 11, 2007, 10:04am
1
I am running Windows Vista on an Asus g2s-a1 laptop.
I desperately need some help on getting rid of this trojan. I have done everything!
DavidR
August 11, 2007, 12:57pm
2
What is your firewall ?
I would probably be a little suspect of World of Warcraft reporting a backdor trojan, how can it tell what is on your system ?
http://forums.wow-europe.com/thread.html?topicId=282518345&sid=1 http://faq.wow-europe.com/en/article.php?id=1149
In the meantime you could check with some anti-spyware tools.AVG anti-spyware (formerly Ewido) SUPERantispyware Spyware Terminator
I would probably be a little suspect of World of Warcraft reporting a backdor trojan, how can it tell what is on your system ?
Online games now scan for malware: both game cheats and password stealing Trojans.
I have spent the past 3 hours googling and researching online everything I can about it. I've come up with nearly squat.
I just spent 3 minutes Googling and came up with the answers: 8)
http://forums.worldofwarcraft.com/thread.html?topicId=383468716&sid=1
http://www.blizzard.com/support/wow/?id=aww02119p
system
August 11, 2007, 7:05pm
4
When I say that I’ve come up with nearly squat, it means that what I did find did not work. Neither of the ‘answers’ in those links worked. None of them did, and there’s been a lot.
DavidR
August 11, 2007, 7:18pm
5
Have you run the other anti-spyware options given ?
If no AV scanner is detecting it, then it must be a new variant.
Your options are to have a look for suspicious files, possibly in the location mentioned in the forum post I found previously:
I have found a copy of this backdoor keylogger. There is only one varation on this backdoor which is an executable file placed inside C:/Program Files/ and is named "howtodo.exe".]I have found a copy of this backdoor keylogger. There is only one varation on this backdoor which is an executable file placed inside C:/Program Files/ and is named "howtodo.exe".
You can submit any suspicious files to VirusTotal for analysis.
Your next option is to contact the World of Warcraft technical support people: they seem eager to help you:
If this guide did not resolve your issue, please visit our online email webform to contact us.
system
August 12, 2007, 9:36am
7
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 http://www.asus.com http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157
–
Also, I have found this NvScv. I am very sure it is a trojan because that’s what googling it says. I don’t know how best to get rid of it, though!
system
August 12, 2007, 9:37am
8
Nevermind! It’s NvSvc, which apparently could either be a trojan or an nVidia thing.
Possibly malicious:
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
http://www.greatis.com/appdata/d/a/asscrpro.exe.htm
O4 - HKCU..\Run: [{E8519905-072E-374F-38A4-F9611BD7564A}] C:\Users\Balros\AppData\Roaming\msnplus.exe
http://www.castlecops.com/s5722-msnplus_exe.html
Unknown:
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
Please disable ‘Hide protected operating system files’ ‘View Hidden Files and Folders’
Post the results here.
system
August 12, 2007, 7:10pm
10
Freewheelin, this is one of the most helpful replies I’ve ever gotten! Thank you so much!
Okay. Here are some specs.
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe
O4 - HKCU..\Run: [{E8519905-072E-374F-38A4-F9611BD7564A}] C:\Users\Balros\AppData\Roaming\msnplus.exe
How is the best way to get rid of it? And I am equally suspicious because I have not installed MSN on this machine. And it is showing the words Bifrose, which is a very key word in my trojan!
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Program Files\ATKGFNEX\GFNEXSrv.exe
Should I give you another HijackThis log? I disabled the hidden files like you asked.
Run HijjackThis! again, tick the box next to this entry and click ‘fix’:
O4 - HKCU..\Run: [{E8519905-072E-374F-38A4-F9611BD7564A}] C:\Users\Balros\AppData\Roaming\msnplus.exe
Reboot and delete the file.
And/or try the Bitdefender scanner:
BitDefender
system
August 13, 2007, 2:54am
12
IT WORKED!
Thank you so much, FreewheelinFrank! Your advice was very helpful and it WORKED. I now know what to do and who to come to if something like this happens again
You rock!
And where to come…
