Eradicating a trojan

To many ads? Support ODJT and see no ads!
G

Guest

Guest
Looks like sometime last week, my office machine (this one, the one I usually post from) picked up a trojan of some sort. I'm surprised, and disappointed, since I run NOD32 on all machines that go online. This machine runs XP home.

The original symptom: IE hijack. Sometimes at random, sites will appear in new windows. Sometimes when I'm doing a Google search, this hijack takes me other places or opens more Windows to additional places.

What I've tried: NOD32 finds nothing. Malwarebytes finds several registry problems. I use the Malwarebytes to automatically remove them, run their scan a second time, and the same handful of problems reappear. If I manually remove the specified registry entries, and then run the scan again, the same handful of problems reappear. Adaware and Spybot S&D don't appear to solve anything related to this problem. Windowslive Onecare scanner finds a handful of problems, but - same story. I have the program "fix" them, and then they reappear.

In my system startup menu, every time I reboot, items that I unchecked and even deleted reappear: here are some of the .dlls: juleboso, wuzyana, vojutulo.

What can I do to PERMANENTLY fix this problem (or set of problems), why didn't NOD catch it in the first place, and how can I protect myself from whatever this is better?
 
www.spynomore.com

Good program, takes care of the "trojan problem" in my office.
Also free AVG will pick up more bad stuff than some paid av programs.
 
Welcome to my hell. :-( Do you have spybot loaded with teatimer active? That will typically catch this type of scum as it will ask if you are sure you want to allow access to the various system startup settings. However, once in place, these malware apps can be a nightmare as they typically load an app which hides the actual program from anti-virus and anti-spyware tools. You may need to find that program and remove it as it is what keeps reinstalling the other crap. It is typically named similar to a valid windows program making this even more difficult. The usual giveaway is the time & date stamp on the files being the same, so if you sort the directory by data, you may be able to find all of the programs with the data from when it was infected giving away the hard to detect filename. Removing it may be as simple as booting into safe mode, disabling it form startup and removing the file. If there is no need to save this system, save yourself time & aggravation by backing up any data you need and reloading it from the ground up. Hopefully it's a DJ system with no other apps and all you need to load is the OS and the app. We usually have a 30 minute rule with user systems - if we can't clean it in 30 minutes, we backup the data, reload the image and put the data back. Not having the luxury of re-imaging you may want to give yourself an hour, but I wouldn't go to much further than that as you might be better off with a fresh reload anyway.

Good luck!
 
My home computer is in the shop right now with a bad case of virus. I clicked on a (Chinese) link a friend sent me and that's when all hell broke loose. It completly took over my machine. Changes my registration on each user account changes my homepage, pop-ups constantly, etc. etc. This was Wed. of last week. I had te machine in the shop by Friday. I run the full suite of McAfee programs, Ad-Aware, etc, etc. My Tech called to tell me he has never seen anything like this in all his years in business. He said I had one NASTY infection. I hope to get my machine back tomorrow - less $200!!! I'm still steaming over this one!!!!
 
Steve Sharp said:
Looks like sometime last week, my office machine (this one, the one I usually post from) picked up a trojan of some sort.
Click to expand...

Did you get the ultra thin ones...? :sqlaugh: :rofl:


I find it surprising as well, as I use ESET Smart Security, and the thing won't even let me go to a site that has malware, and it strips any incoming junk out of my email!

I'd contact the folks at ESET -- they have an excellent support team, and should be able to help you out :)
 
Steve also I see one problem for the office computer --XP home-- you should be using pro on a business system

also download hijack_this if you need the site i'll give it to you

also go to spywarewarrior.com and have a read in the boards for tech help on how they can help to remove it

they will ask you to do a hijack_this log and post it to them that way they can help you
it will help

I have just done 4x virus/malware programs from 3x systems and worked well

if you need any help just send me a message
 
DJ Wes said:
My home computer is in the shop right now with a bad case of virus. I clicked on a (Chinese) link a friend sent me and that's when all hell broke loose. It completly took over my machine. Changes my registration on each user account changes my homepage, pop-ups constantly, etc. etc. This was Wed. of last week. I had te machine in the shop by Friday. I run the full suite of McAfee programs, Ad-Aware, etc, etc. My Tech called to tell me he has never seen anything like this in all his years in business. He said I had one NASTY infection. I hope to get my machine back tomorrow - less $200!!! I'm still steaming over this one!!!!
Click to expand...

What are friends for.
 
DjDennis said:
Steve also I see one problem for the office computer --XP home-- you should be using pro on a business system

also download hijack_this if you need the site i'll give it to you

also go to spywarewarrior.com and have a read in the boards for tech help on how they can help to remove it

they will ask you to do a hijack_this log and post it to them that way they can help you
it will help

I have just done 4x virus/malware programs from 3x systems and worked well

if you need any help just send me a message
Click to expand...

Really Dennis?
I mean, unless he has a need to have a large network of computers, I would suspect that XP home is fine for the 2-3 computers he has in his business. Professional provides nothing more than additional networking capabilities and remote desktop features that aren't really necessary in a small business.
 
For me it is faster to save the data and rebuild the computer to remove some Trojans. Many of them hide in system files, and if the system files are removed the system will no longer boot. WHen you clean it removes the trojan, but a reboot, they come back again.
 
Restore your computer to a earlier time using windows xp home system restore. Steve Go to the start button click all programs and system tools and u will see system restore. it worked for me good luck.
 
Yes! I agree with MBM!

Once a system is infected, software can try to remove it, but there will be remnants left behind...

The only way to truely remove it is to do a fresh install on a clean drive.

Yeah, I know, a lot of extra work, but if you surf safe, you wouldn't be in this situation.

In email, don't open attachments, or click unfamiliar links, and only surf sites you trust.
Also, be sure to have proper protection. I use AVG free, but eset is a better option, especially if you're prone to invasion.
 
I agree with Jeff all the anti-blah blah utilities in the world don't guarantee you a clean system. When ever a computer I admin gets infected with a virus, I format and reinstall. It's a lot of work but the only way to assure a clean system.

Personally I only run AV as an active monitor to insure that I don't get viruses by detecting them before they execute. If I did happen to get infected I wouldn't trust any app to remove it, I'd format and reinstall after I dumped all my files to a DVD and scanned the files on a separate system.
 
Jeff that way you have better control

its ok for a home user than a business using xp pro

but hey each to thier own

for me to do a correct job xp pro is what I tell business clients as xp home you cant even manage users like xppro can
 
Hackers usually don't target Vista :sqbiggrin:


As for Steve's issue -- he's already paying for a top of the line system. ESET supports their users, and that comes as part of the price tag.

They have the tools to eradicate anything, without trashing yer system and starting over... Use yer interface ;)
 
You must log in or register to reply here.
Top Bottom
Back