Trojanproxy.ranky.nbq Anyone Know About It?

TrojanProxy.Ranky.NBQ This has infected a good friends computer. He has XP with SP2 and uses NOD32 AV, NOD says it can't clean it so he deletes it and a little bit later it's back popping up a infection window. He is from Finland if that might make some difference.

I've done a bit of searching and it seems to be a NOD problem as its all Google returns is links related to NOD32. It was added to there virus definitions on 3-10-2005 yet when I go to NOD's site and search they say there's no info found try another search.

One odd thing I noticed since I use NOD is the control panel in MOD is a pale green like all of the NOD varieties I've used where his is bright red.


Here's a screenshot he posted on my forum.

[external image: Posted Image]

[external image: Posted Image]

Any info on this be appreciated as he is a close friend and I'd sure like to help him out. You know how it goes when someone you know is troubled by this type of thing… it gets really frustrating. Thanks Everyone!! Hope I stuck this in the right place! Aloha, LoLo

what is nod? lmao

try downloading and running this stinger program:
http://vil.nai.com/vil/stinger/

ALso, try this online scan:
1. http://housecall.trendmicro.com/

good luck

wng

http://www.nod32.com <– check it out. AV program. Very good one. Microsoft uses it to protect there servers and are planning on integrating it into the next update of there OS if the news I heard was right.

Not many people know of them, there in Australia. They make one of the best rated AV programs according to cert and the virus testing lab people. I like it because it's very fast when you want it to scan a disk or drive. Much faster than any of the ones I have tried. In 5 years of using it myself on my server and personal comp I've had one false positive and thats all.

Thanks wng, I think this is something new. As I mentioned in the post it was put in the database definition updates the 10th of March. Hopefully there may be more info at NOD by now.

darn bug writers. Got it figgured out. It is pretty new came out end of Feb. and goes under several names. I finally found it by eliminating the last portion of the name Ranky XXX Theres about a hundred differnt ends for it. The common part of the name is "TrojanProxy" the rest is variable. It runs on startup or reboot each time reloading itself and also trys to disable AV software to make detection difficult… I also did a lookup on the IP shown in NOD's control panel. That same IP was also on a few Virus definition and Identification sheets. It was from : Trying [removed] at ARIN Trying 204.8.222 at ARIN OrgName: JustEdge Networks OrgID: JUSTE Address: 71 Ackerman Ave #161 City: Clifton StateProv: NJ PostalCode: 07011 Country: US ReferralServer: rwhois://rwhois.justedge.net:4321 NetRange: 204.8.216.0 - 204.8.223.255 CIDR: 204.8.216.0/21 NetName: JE-BLK-1 NetHandle: NET-204-8-216-0-1 Parent: NET-204-0-0-0-0 NetType: Direct Allocation NameServer: NS1.JUSTEDGE.NET NameServer: NS2.JUSTEDGE.NET Comment: RegDate: 2004-08-19 Updated: 2004-08-19 OrgTechHandle: JUSTE-ARIN OrgTechName: JustEdge OrgTechPhone: [removed] OrgTechEmail: [removed] # ARIN WHOIS database, last updated 2005-03-15 19:10 # Enter ? for additional hints on searching ARIN's WHOIS database. One down Im sure my buddy will be happy! I like helping people get things fixed. Good feeling. Aloha, LoLo

lolo, there are places to submit the bad ip addresses…. I just cant think of where…. Maybe another member will help me out on this.. glad to hear you got it all worked out wng

Thanks wng! Ya my friend was really happy!

If you remember the place to turn the IP over to post it up please, I've had a couple of occasions where I'd like to have been able to let someone know whats going on without incriminating myself or making myself a target if you know what I mean..

Here's a good address to have if you get much spam… uce at ftc.gov

I forward all mine to them, at one point I was getting absolutely swamped with spam - I hadn't realized my forum I have running on a old pc on my home cable was literally giving my address out to anyone that wanted a address…. It wasn't visible, my entire forum is password to enter, registration ok'ed by admin (me) only, but with the right scanner it was right there. I averaged well over 200 - 400 spams a day! [external image: Posted Image]