Heads Up!! - Viruses, Trojans etc.
Thread Starter
Joined: Feb 2000
Posts: 1,993
Likes: 512
From: UK
Heads Up!! - Viruses, Trojans etc.
To anyone and everyone (particularly the 'techie' mods) ...
yesterday and today, while browsing R&N, my AV program(AVG) popped up Virus/Trojan warnings - once yesterday, twice today. Zone Alarm warned me of an attempt to make contact by whatever it was that was detected. I'm afraid that I took the coward's way out and just got AVG to 'heal' the problem. No repetitions on Tech Log, CRM, Questions, Military Aircrew, J B or Aviation Nostalgia. I'm not sufficiently savvy about these things to know what the best course should be but perhaps Danny's IT whizzes can check/ advise??
Just because I'm paranoid, it doesn't mean they're not out to get me!!
yesterday and today, while browsing R&N, my AV program(AVG) popped up Virus/Trojan warnings - once yesterday, twice today. Zone Alarm warned me of an attempt to make contact by whatever it was that was detected. I'm afraid that I took the coward's way out and just got AVG to 'heal' the problem. No repetitions on Tech Log, CRM, Questions, Military Aircrew, J B or Aviation Nostalgia. I'm not sufficiently savvy about these things to know what the best course should be but perhaps Danny's IT whizzes can check/ advise??
Just because I'm paranoid, it doesn't mean they're not out to get me!!
Joined: Mar 2006
Posts: 113
Likes: 0
From: Finland - East of Sweden
Have you had all the Service Packs and OS patches applied? Have you got the automatic system updater activated? (Requires Service Pack 1 or 2 installed first) Seems you've been contacted by using some left-open UDP (?) ports through the firewall purely coincidentally with your browsing, and by the looks of it, something has been smuggled in as a result of this activity as your AVG had detected an infected file (?).
Joined: Dec 2005
Posts: 1,694
Likes: 15
From: Wellington,NZ
If it happens again, make a note of the name of the trojan. Try moving it to the virus vault, for later transmission to AVG.
Then Google the name. There are likely to be a number of computer help sites that have posted procedure for dealing with it. Unless you're unlucky enough to be the first user affected!
The procedure is usually more complex than just having the AV software delete or heal it, as it can leave traces in a variety of places, and if the trojan then downloads something, it can be bundled with stuff to reactivate it after it's been deleted.
You don't happen to remember the name, do you? I've had an encounter with a couple of these recently.
Then Google the name. There are likely to be a number of computer help sites that have posted procedure for dealing with it. Unless you're unlucky enough to be the first user affected!
The procedure is usually more complex than just having the AV software delete or heal it, as it can leave traces in a variety of places, and if the trojan then downloads something, it can be bundled with stuff to reactivate it after it's been deleted.
You don't happen to remember the name, do you? I've had an encounter with a couple of these recently.
Thread Starter
Joined: Feb 2000
Posts: 1,993
Likes: 512
From: UK
Thank you both.
Will try to note the details if it recurs but (touching wood) nothing , so far, today. I'm afraid that the 'geeky' stuff about ports etc passes me by, but the one thing I've learned from practical experience over the last fourteen or fifteen years with 'pooters' is .... don't allow ANY AUTOMATIC anything!!!!!
What I wish to do, and what some anonymous bunch of program writers wish to do, with my machine, may well be poles apart. At the end of the day, a full re-install solves most things and, using Windoze, it has, of necessity, become a regular ritual
Will try to note the details if it recurs but (touching wood) nothing , so far, today. I'm afraid that the 'geeky' stuff about ports etc passes me by, but the one thing I've learned from practical experience over the last fourteen or fifteen years with 'pooters' is .... don't allow ANY AUTOMATIC anything!!!!!
What I wish to do, and what some anonymous bunch of program writers wish to do, with my machine, may well be poles apart. At the end of the day, a full re-install solves most things and, using Windoze, it has, of necessity, become a regular ritual
Joined: Feb 1998
Aviation Qualifications: ATPL
Posts: 1,595
Likes: 0
From: Formerly of Nam
I recently was on the net when suddenly an unauthorised program promptly installed itself, made itself a desktop item and planted 3 trojans. Then it said pay them money to have them removed! 
My anti-virus imediately removed one stand-alone trojan (Zlob), but 2 files were infected in Windows Sys32 and couldnt be repaired (ldCA93.tmp and dfrgsrv.exe). ldCA93 ensured Zlob was reinstaled at next bootup.Took the whole bloodey day with the anti-virus to get everything cleaned incl the registry.
The collosal pr!cks who instaled this was called "Spyware Guard" I think. Arragant sh!ts even instaled a desktop shortcut to there site!
Anyone else?
My anti-virus imediately removed one stand-alone trojan (Zlob), but 2 files were infected in Windows Sys32 and couldnt be repaired (ldCA93.tmp and dfrgsrv.exe). ldCA93 ensured Zlob was reinstaled at next bootup.Took the whole bloodey day with the anti-virus to get everything cleaned incl the registry.
The collosal pr!cks who instaled this was called "Spyware Guard" I think. Arragant sh!ts even instaled a desktop shortcut to there site!
Anyone else?
Last edited by Slasher; 2nd April 2006 at 06:58.
Joined: Dec 2005
Posts: 1,694
Likes: 15
From: Wellington,NZ
Yep, Spyware Quake/ Zolob downloader. Been there, done that. Disgusting critter. Sent the registrant of the Spywarequake website a nasty letter.
Took me over 4 hours to clean it,(coz I aint that slick) then a couple more over the next few days to be sure. Reference http://www.pprune.org/forums/showthr...=211864&page=2
There was some good advice from forum sites on exactly what to do.
Took me over 4 hours to clean it,(coz I aint that slick) then a couple more over the next few days to be sure. Reference http://www.pprune.org/forums/showthr...=211864&page=2
There was some good advice from forum sites on exactly what to do.
Joined: Dec 2005
Posts: 1,694
Likes: 15
From: Wellington,NZ
PPS, Spyware Guard is a very excellent freeware utility by Javacool, a companion to Spyware Blaster, and not to be confused with SpywareQuake.
Spyware guard is here and well worth a looksee.http://www.javacoolsoftware.com/spywareguard.html
Spyware guard is here and well worth a looksee.http://www.javacoolsoftware.com/spywareguard.html
Joined: Feb 1998
Aviation Qualifications: ATPL
Posts: 1,595
Likes: 0
From: Formerly of Nam
Thanks Markjoy much apreciated. I stand corrected - yep its SpywareQuake the stinking bloodey r-soles. I had exactly the same probs as you stated on your link.
If youve squizzed my profile then yeah, I know where I probabley picked it up. I'll have a look at that Ewido.
Again thanks for the feedback mate.
If youve squizzed my profile then yeah, I know where I probabley picked it up. I'll have a look at that Ewido.
Again thanks for the feedback mate.
Joined: Mar 2006
Posts: 113
Likes: 0
From: Finland - East of Sweden
Let me stress once again that you absolutely positively need to have your Windows kept up-to-date. The automatic update function is for your convinience and protection.Those unpatched Windows vulnerabilites will be exploited on your machine! AV programs may be able to give a post-infection message, as in this case, but it's also very often that the AV program is actually ordered to shut itself down by the malware at the infection time!
The way to start the update process is to use your Explorer and point to www.windowsupdate.com .
The way to start the update process is to use your Explorer and point to www.windowsupdate.com .
Joined: Dec 2005
Posts: 1,694
Likes: 15
From: Wellington,NZ
DBTL
Couldn't agree more. I check windows update 3-7 times a week, and AV/Spyware updates at least every day. Got a few antispyware programs, too. Still the trojan did it's thing, possibly because it's a fairly new variant, I don't really know.
So even with everything up to date, which is important security, new spyware/virus are being developed. A bit like bugs/flu evolving in advance of medical practice.
(In fact, IMO, the analogy is a bit scarily accurate)
BTW, I now have 2 more antispy programs than I did a week ago.
Couldn't agree more. I check windows update 3-7 times a week, and AV/Spyware updates at least every day. Got a few antispyware programs, too. Still the trojan did it's thing, possibly because it's a fairly new variant, I don't really know.
So even with everything up to date, which is important security, new spyware/virus are being developed. A bit like bugs/flu evolving in advance of medical practice.
(In fact, IMO, the analogy is a bit scarily accurate)
BTW, I now have 2 more antispy programs than I did a week ago.
Joined: Feb 1998
Aviation Qualifications: ATPL
Posts: 1,595
Likes: 0
From: Formerly of Nam
Guys I didnt mean NEVER update windows. I meant sudden puter problems occur because something was automaticaly downloaded and instaled from Windows that stuffed things up. Last one assumed I didnt have SP2 which I already had.
I check once a week on average and go through the "Custom" option. Its important to read the "details..." link to know exactly whats gonna happen once the stuffs instaled.
I check once a week on average and go through the "Custom" option. Its important to read the "details..." link to know exactly whats gonna happen once the stuffs instaled.
Joined: Mar 2006
Posts: 113
Likes: 0
From: Finland - East of Sweden
If something seems to be going wrong after installing an update or whatever, driver, etc (I've never experienced it having happened after a legal Windows update), hit F8 at boot-up and choose "use the most recent settings that worked".
The AV I use gets updated automatically as per need, and this may be up to 4 times a day when the virus writers have been particularly busy, so the time slot for vulnerability is quite narrow.
The AV I use gets updated automatically as per need, and this may be up to 4 times a day when the virus writers have been particularly busy, so the time slot for vulnerability is quite narrow.
Joined: Feb 2006
Posts: 140
Likes: 0
From: Ask Crewing
Another preventitive measure is to avoid using Internet Explorer. It is the cause for the majority of security breaches whilst surfing the net.
Use Mozilla Firefox (or any Mozilla Browser) for just a week and you will notice a substantial reduction in the amount of spyware, and other nasties from getting to your machine..
www.getfirefox.com
Use Mozilla Firefox (or any Mozilla Browser) for just a week and you will notice a substantial reduction in the amount of spyware, and other nasties from getting to your machine..
www.getfirefox.com
Joined: Mar 2006
Posts: 113
Likes: 0
From: Finland - East of Sweden
Originally Posted by asuweb
Another preventitive measure is to avoid using Internet Explorer.
www.getfirefox.com
www.getfirefox.com
