i have a trojan problem...PLEASE HELP

FreewheelinFrank · 2006-10-04T11:54:33.000Z

WT*! I could’ve sworn that second post wasn’t there before! ???

system · 2006-10-04T15:03:18.000Z

well every time it detects something it says recommended action :move to chestbox, whats a noob to do?

FreewheelinFrank · 2006-10-04T16:59:31.000Z

I can only repeat what I said before:

You will need to give us some more information: the name and location of the malware. This is the sort of thing we need:

Avast just picked up win32: Horst-BJ in our morning boot-time scan, thank God. It was in C: Docs and Sets\All Users\Application Data\CanonBJ\IJPrinter\CNMWindows\Canonip6600D\Installer\Inst2\helpkicker.exe

FreewheelinFrank · 2006-10-04T17:40:00.000Z

In addition:

Win2000 has no firewall, so as soon as you connect to the internet, you are going to get attacked. Within a few minute, your computer will be pwned!

On top of that, MS no longer provides updates for Win2000, surfing with IE is going to leave you open to attack if you stray onto the wrong website. Within a few minutes, yep, you guessed it, your computer will be pwned!

Get a good free firewall like Zone Alarm and learn how to set it up, get an alternative browser like Firefox or Opera, then format again. Install avast!, Zone Alarm and the browser of your choice and maybe this time you’ll survive a little longer!

It would also help if you update Win2000 with all the secuirty fixes.

Make sure the first site you visit is Microsoft Update. Download all critical updates.

Here’s a good link to help you set up Zone Alarm:

http://www.zonelabs.com/store/content/support/zasc/gettingStarted.jsp?anchor=alerts&lid=zasupp_u

system · 2006-10-04T18:41:04.000Z

FreewheelinFrank post:8:

I can only repeat what I said before:

You will need to give us some more information: the name and location of the malware. This is the sort of thing we need:

Avast just picked up win32: Horst-BJ in our morning boot-time scan, thank God. It was in C: Docs and Sets\All Users\Application Data\CanonBJ\IJPrinter\CNMWindows\Canonip6600D\Installer\Inst2\helpkicker.exe

do you even read things before you post? i already said one was in the win32 folder and the other in the temp internet folder

system · 2006-10-04T18:41:55.000Z

yeah i dled zone alarm, quite a good program!..thanks for the tips

FreewheelinFrank · 2006-10-04T18:46:23.000Z

do you even read things before you post? i already said one was in the win32 folder and the other in the temp internet folder

As I said, we need the name of the malware, and the path and filename, as per the example.

But I think it’ll be somebody else helping you out from now on, numbnuts.

system · 2006-10-04T20:02:20.000Z

FreewheelinFrank post:12:

do you even read things before you post? i already said one was in the win32 folder and the other in the temp internet folder

As I said, we need the name of the malware, and the path and filename, as per the example.

But I think it’ll be somebody else helping you out from now on, numbnuts.

thats alright your about as useful as tits on a bull

system · 2006-10-04T23:35:35.000Z

Guy (or girls, as the case may be). There’s a problem to be solved.

zimba post:1:

(… it was in the internet temp file and another in the win32) so i booted in safe mode and deleted it…i repeated this process atleast 5 times!! i just formatted my computer a couple hours ago and wow once again i get a trojan warning!

What did you do after reformatting? Check email? Surf? Download files? Install something from disk? I mean, certainly a reformat required re-installtion of programs and/or data.

system · 2006-10-05T11:40:59.000Z

zimba post:1:

okay i got my new comp bout a month ago for college where im at right now…i dled avast since my room mate told me its what to use…then suddenly i got this trojan warning, i try to delete and move the file but it wouldnt let me stating that something else was already using it (was in the internet temp file and another in the win32) so i booted in safe mode and deleted it…i repeated this process atleast 5 times!! i just formatted my computer a couple hours ago and wow once again i get a trojan warning! i moved it to the chest successfully but i wanna know what could be causing this and what i can do to stop it! PLEASE GUYS ITS DRIVING ME NUTS

Hello,

I have exactly the same problem as Zimba.; delete, delete, etc.
The only option is to move the trojan in the chest, succesfully…'But what could be causing
this???, to laeve it in the chest forever?
I have xp.

FreewheelinFrank · 2006-10-05T12:15:53.000Z

Hi Satine777,

Please could you start your own thread so people can see your post and offer help?

It will help us a lot if you can give us some more information: the name and location of the malware. This is the sort of thing we need:

Avast just picked up win32: Horst-BJ in our morning boot-time scan, thank God. It was in C: Docs and Sets\All Users\Application Data\CanonBJ\IJPrinter\CNMWindows\Canonip6600D\Installer\Inst2\helpkicker.exe

system · 2006-10-08T19:03:46.000Z

Thank you for the reply!

Here are the files, they, Avast!, recommend me to store in the chest:
C:\WINDOWS\system32\kernel32.dll Bestandscategorie: 0
BestandsID: 0000000002 Originele bestandsnaam: C:\WINDOWS\system32\winsock.dll Bestandscategorie: 0
BestandsID: 0000000003 Originele bestandsnaam: C:\WINDOWS\system32\wsock32.dll Bestandscategorie: 0
BestandsID: 0000000004 Originele bestandsnaam: C:\Documents and Settings\Bremer\Local Settings\Temp\p2psetup.exe Bestandscategorie: 1
BestandsID: 0000000005 Originele bestandsnaam: C:\Documents and Settings\Bremer\Local Settings\Temporary Internet Files\Content.IE5\8ZNFM85H\p2psetup[1].exe Bestandscategorie: 1
BestandsID: 0000000006 Originele bestandsnaam: C:\System Volume Information_restore{AE2A05D5-0BFF-4A26-84F5-38FD9C43AE12}\RP30\A0002258.exe Bestandscategorie: 1

And this I found, in according with viruses, when I searched in ‘documents and settings’ on my pc:

C:\WINDOWS\system32\kernel32.dll Bestandscategorie: 0
BestandsID: 0000000002 Originele bestandsnaam: C:\WINDOWS\system32\winsock.dll Bestandscategorie: 0
BestandsID: 0000000003 Originele bestandsnaam: C:\WINDOWS\system32\wsock32.dll Bestandscategorie: 0
BestandsID: 0000000004 Originele bestandsnaam: C:\Documents and Settings\Bremer\Local Settings\Temp\p2psetup.exe Bestandscategorie: 1
BestandsID: 0000000005 Originele bestandsnaam: C:\Documents and Settings\Bremer\Local Settings\Temporary Internet Files\Content.IE5\8ZNFM85H\p2psetup[1].exe Bestandscategorie: 1
BestandsID: 0000000006 Originele bestandsnaam: C:\System Volume Information_restore{AE2A05D5-0BFF-4A26-84F5-38FD9C43AE12}\RP30\A0002258.exe Bestandscategorie: 15-10-2006 2:31:50 1160008310 Bremer 2444 Sign of “Win32:Lineage-197 [Trj]” has been found in “C:\Documents and Settings\Bremer\Local Settings\Temp\p2psetup.exe[UPX]” file.
5-10-2006 2:33:41 1160008421 Bremer 2444 Sign of “Win32:Lineage-197 [Trj]” has been found in “C:\Documents and Settings\Bremer\Local Settings\Temporary Internet Files\Content.IE5\8ZNFM85H\p2psetup[1].exe[UPX]” file.
5-10-2006 2:41:30 1160008890 Bremer 2444 Sign of “Win32:Lineage-197 [Trj]” has been found in “C:\System Volume Information_restore{AE2A05D5-0BFF-4A26-84F5-38FD9C43AE12}\RP30\A0002258.exe[UPX]” file.

I hope this is some or enough information.

I read in this posting that it is a good idea to dowload Zone Alarm. I am planning to do that.

I myself downloaded, from a link on a page from Avast!: Spybot search and destroy.
I think that’s a good program as well:-)
I would like to hear your opinion:-), about this:-)

Thank you!

Lisandro · 2006-10-08T19:28:36.000Z

Satine777 post:17:

C:\WINDOWS\system32\kernel32.dll Bestandscategorie: 0
C:\WINDOWS\system32\winsock.dll Bestandscategorie: 0
C:\WINDOWS\system32\wsock32.dll Bestandscategorie: 0

These files seem to be on the System folder of the Chest, i.e., they’re there for backup purposes.
Maybe Bestandscategorie: 0 means exactly this.

Satine777 post:17:

I myself downloaded, from a link on a page from Avast!: Spybot search and destroy.
I think that’s a good program as well:-)
I would like to hear your opinion:-), about this:-)

Very good program. No conflicts with avast.

FreewheelinFrank · 2006-10-08T21:36:22.000Z

I think the three files Tech mentioned may well be the protected copies of system files which avast! stores in the chest.

p2psetup[1].exe is a P2P adware file. Some P2P networks come bundled with adware/spyware and are best avoided.

See here:

http://www.spybot.info/en/articles/infected_and_clean.html

The files detected seem to be in temp files and System Restore files.

To delete temp files, try using CleanUp:

http://www.stevengould.org/software/cleanup/

I also suggest you run Spybot and also Ad-Aware and a-Squared free to check for traces of adware:

http://www.download.com/3000-2144-10045910.html

http://www.emsisoft.com/en/software/free/

To remove files in System Restore, you will need to temporarily disable System Restore and then turn it back on again, as described here:

http://www.pchell.com/virus/systemrestore.shtml

and here:

http://antivirus.about.com/od/windowsbasics/a/systemrestore.htm

system · 2006-10-09T17:31:44.000Z

Thank you all, very very much, for the good reply’s, which will help me a lot!

As soon if I have the time I’m gona read them!

Satine.

!

system · 2006-10-11T04:23:23.000Z

Hi Guys,

So, it is early, so I have the time to read your postings, and the links.

I have an announcement to make. I’m also curious, what you think about my decision.

I think I am gonna buy another virus scanner as Avast!. Not that I think that Avast! is not good!!!No, I knów Avast! is very good, most of the friends of my brother, are saying that and thinking so!!!

But…and know comes the ‘problem’: My Englisch Language is not so good, yes, I can have little conversations, and yes I can follow a movie from BBC, whén there is also Englisch subtitle. I can write postings, my pronunciation is véry good.

But,…this here is also technical terms, which is difficult for me in Dutch, so much more difficult in Englisch.

My brother gave me the computer, and he instal Avast, thinking, there is also Dutch
explanation. Which was not the case(yet).

So, I asked some advice of some of my colleagues: I said to them that I have Avast! with Englisch explanation of things, wich is very hard for me to understand.
(My brother lives in Amsterdam, I live in a little town, on the other side of the country.)
I got some advices from different people: It is better, that I am gonna buy a
Virus scanner with comlete Dutch explenation and interpretation. And than I have to do Avast! and all of it’s componenets away from my pc(un-install), and then, after that, I have to install Norton 7, the newest virus scanner with completely Dutch version and explenation.
So that it will not be so hard for me. Now I have to take the dictionary often, and it takes a long time for me to understand things.

So people advised me to buy Norton 7, and one of my co-workers, is gonne help me uninstal Avast!, and install Norton, whitin a few days.

Now I have a question.
When I uninstall Avast!, people told me, that then, Avast! will take the viruses in the chest with it.
Is that true? I heard it from more persons.

Because, recently, I also uninstall Avast!, and I install Norton 5. Than my pc gave me a warning, that Norton 5 is too old. So I quickly uninstall Norton, an re-install Avast. And then again, a warning; the same viruses wich I had before the Un-install came, and where recommended again
to me to do in the chest.!!!

So, what is true, from what my friends here told me; that when you uninstall Avast! it takes the viruses in the chest with it???
Because here above, it was obviously not the case.

Does anyone want to answer me? Thank you!

And once again, I am gonna change from virus scanner, not because Avast! is not good, no, Avast! is very good! I am gonna Uninstal it, and take another virus-scanner because of the Dutch support!

I hope for your understanding!

And I hope for an answer!

With kind regards!

Satine.

polonus · 2006-10-11T06:01:36.000Z

Hallo Satine777,

Uit je posting heb ik het vermoeden dat je Nederlandstalig bent. Waarom installeer je dan niet de Nederlandse versie van Avast? Die is even goed als de Engelse en er is ook een Nederlandstalig forum. Dan hoef je niet uit te wijken naar de Engelstalige versie, als je die taal niet voldoende machig bent.

polonus

FreewheelinFrank · 2006-10-11T06:40:00.000Z

I’m sure Polonus just said the same thing, but isn’t avast! available in Dutch?

http://www.avast.com/eng/avast-translators.html

DavidR · 2006-10-11T10:15:16.000Z

Yes a Dutch version is available for download, http://www.avast.com/eng/download-avast-home.html.

system · 2006-10-12T09:47:10.000Z

DavidR,

Of course, I read that piece, what you copied for me:-) And dowloaded and installed it, before I read and saw it.

And yes, some things, like lists, are in Dutch, but the long pieces of tekst, which give explanations, are in English. And then there is written that they(Avast!), are working on a Dutch version.
Maybe I make a mistake(It shall not be the first time;-), so I gonna check the links.

Laterz.

Announcements