View Full Version : Heads Up!! - Viruses, Trojans etc.
Cornish Jack
31st Mar 2006, 18:11
To anyone and everyone (particularly the 'techie' mods) ...
yesterday and today, while browsing R&N, my AV program(AVG) popped up Virus/Trojan warnings - once yesterday, twice today. Zone Alarm warned me of an attempt to make contact by whatever it was that was detected. I'm afraid that I took the coward's way out and just got AVG to 'heal' the problem. No repetitions on Tech Log, CRM, Questions, Military Aircrew, J B or Aviation Nostalgia. I'm not sufficiently savvy about these things to know what the best course should be but perhaps Danny's IT whizzes can check/ advise??
Just because I'm paranoid, it doesn't mean they're not out to get me!!:eek: ;) ;)
Have you had all the Service Packs and OS patches applied? Have you got the automatic system updater activated? (Requires Service Pack 1 or 2 installed first) Seems you've been contacted by using some left-open UDP (?) ports through the firewall purely coincidentally with your browsing, and by the looks of it, something has been smuggled in as a result of this activity as your AVG had detected an infected file (?).
Tarq57
1st Apr 2006, 01:52
If it happens again, make a note of the name of the trojan. Try moving it to the virus vault, for later transmission to AVG.
Then Google the name. There are likely to be a number of computer help sites that have posted procedure for dealing with it. Unless you're unlucky enough to be the first user affected!
The procedure is usually more complex than just having the AV software delete or heal it, as it can leave traces in a variety of places, and if the trojan then downloads something, it can be bundled with stuff to reactivate it after it's been deleted.
You don't happen to remember the name, do you? I've had an encounter with a couple of these recently.
Cornish Jack
1st Apr 2006, 12:59
Thank you both.
Will try to note the details if it recurs but (touching wood) nothing , so far, today. I'm afraid that the 'geeky' stuff about ports etc passes me by, but the one thing I've learned from practical experience over the last fourteen or fifteen years with 'pooters' is .... don't allow ANY AUTOMATIC anything!!!!!:*
What I wish to do, and what some anonymous bunch of program writers wish to do, with my machine, may well be poles apart. At the end of the day, a full re-install solves most things and, using Windoze, it has, of necessity, become a regular ritual:yuk:
Slasher
2nd Apr 2006, 03:00
I recently was on the net when suddenly an unauthorised program promptly installed itself, made itself a desktop item and planted 3 trojans. Then it said pay them money to have them removed! :mad:
My anti-virus imediately removed one stand-alone trojan (Zlob), but 2 files were infected in Windows Sys32 and couldnt be repaired (ldCA93.tmp and dfrgsrv.exe). ldCA93 ensured Zlob was reinstaled at next bootup.Took the whole bloodey day with the anti-virus to get everything cleaned incl the registry.
The collosal pr!cks who instaled this was called "Spyware Guard" I think. Arragant sh!ts even instaled a desktop shortcut to there site! :yuk:
Anyone else?
Slasher
2nd Apr 2006, 03:10
I agree with Cornish J - dont allow any automatic updates of anything!
Especialy &#$>*%@^ WINDOWS!!!
Tarq57
2nd Apr 2006, 03:12
Yep, Spyware Quake/ Zolob downloader. Been there, done that. Disgusting critter. Sent the registrant of the Spywarequake website a nasty letter.
Took me over 4 hours to clean it,(coz I aint that slick) then a couple more over the next few days to be sure. Reference http://www.pprune.org/forums/showthread.php?t=211864&page=2
There was some good advice from forum sites on exactly what to do.
Tarq57
2nd Apr 2006, 03:16
PS Slasher...
Just had a look at your profile. Highly recomend Ewido antispyware. Seems to work well.:E
Tarq57
2nd Apr 2006, 03:19
PPS, Spyware Guard is a very excellent freeware utility by Javacool, a companion to Spyware Blaster, and not to be confused with SpywareQuake.
Spyware guard is here and well worth a looksee.http://www.javacoolsoftware.com/spywareguard.html
Slasher
2nd Apr 2006, 04:24
Thanks Markjoy much apreciated. I stand corrected - yep its SpywareQuake the stinking bloodey r-soles. I had exactly the same probs as you stated on your link.
If youve squizzed my profile then yeah, I know where I probabley picked it up. I'll have a look at that Ewido.
Again thanks for the feedback mate. :ok:
Let me stress once again that you absolutely positively need to have your Windows kept up-to-date. The automatic update function is for your convinience and protection.Those unpatched Windows vulnerabilites will be exploited on your machine! AV programs may be able to give a post-infection message, as in this case, but it's also very often that the AV program is actually ordered to shut itself down by the malware at the infection time!
The way to start the update process is to use your Explorer and point to www.windowsupdate.com (http://www.windowsupdate.com) .
Tarq57
2nd Apr 2006, 23:57
DBTL
Couldn't agree more. I check windows update 3-7 times a week, and AV/Spyware updates at least every day. Got a few antispyware programs, too. Still the trojan did it's thing, possibly because it's a fairly new variant, I don't really know.
So even with everything up to date, which is important security, new spyware/virus are being developed. A bit like bugs/flu evolving in advance of medical practice.
(In fact, IMO, the analogy is a bit scarily accurate)
BTW, I now have 2 more antispy programs than I did a week ago.
Slasher
3rd Apr 2006, 05:35
Guys I didnt mean NEVER update windows. I meant sudden puter problems occur because something was automaticaly downloaded and instaled from Windows that stuffed things up. Last one assumed I didnt have SP2 which I already had.
I check once a week on average and go through the "Custom" option. Its important to read the "details..." link to know exactly whats gonna happen once the stuffs instaled.
If something seems to be going wrong after installing an update or whatever, driver, etc (I've never experienced it having happened after a legal Windows update), hit F8 at boot-up and choose "use the most recent settings that worked".
The AV I use gets updated automatically as per need, and this may be up to 4 times a day when the virus writers have been particularly busy, so the time slot for vulnerability is quite narrow.
asuweb
3rd Apr 2006, 12:51
Another preventitive measure is to avoid using Internet Explorer. It is the cause for the majority of security breaches whilst surfing the net.
Use Mozilla Firefox (or any Mozilla Browser) for just a week and you will notice a substantial reduction in the amount of spyware, and other nasties from getting to your machine..
www.getfirefox.com
Another preventitive measure is to avoid using Internet Explorer.
www.getfirefox.com (http://www.getfirefox.com)
Correction suggested: "unpatched Internet Explorer". There are several security updates for the earlier Firefoxes as well. Many vulnerabilities rest on system issues that are not browser-dependent. NOT using IE isn't your secret passage to a permanent net browsing security.