What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan: Router/internet inop, Then auto emailing spam

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hello,

Followed your instuctions..Ran ewido in "Safe Mode" then made HJT Log.

My intro hereMaybe rambled..lol flustered had something trying to send 100's of emails…and it also took over my linksys router.
Additional: something is trying to gain access, but keeps getting blocked "Now" by Firewall zone alarm.
It's on TCP port 57801, adsl 64-149-238-150. DSL invnca.sbcglobal.net
AND various 64.149…..IP's (Net Bios) udp port 3709

Hope I supplied enough to get my computer 100% clean. worried about information leaks..I did start changing passwords from another system.

Many Thanks when time permits,
George

My logs:
ewido anti-malware - Scan report
———————————————————

+ Created on: 7:54:33 PM, 6/12/2006
+ Report-Checksum: 5D91A8B7

+ Scan result:

:mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7dq40zlh.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned with backup
:mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7dq40zlh.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7dq40zlh.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7dq40zlh.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
:mozilla.20:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7dq40zlh.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup


::Report End


___________________________________________

Logfile of HijackThis v1.99.1
Scan saved at 8:12:14 PM, on 6/12/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Ms Network Services] swchst.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Ms Network Services] swchst.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: PokerTime Poker - {7220F1C9-B7E0-47a6-A0BD-D5B3940BCC79} - C:\Program Files\PokerTimeMPP\MPPoker.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1127234437657
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1130783669870
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe


PS: also, ran this BitDefender very early on and here's the report.
no it didn't work, but I can post whatevers needed. Thanks again
Post #2
hi ItsGeorge,

first disable spybots tea timer so it dosnt interfere with the fix, how:

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
————————————
next:
scan with HJT, put a checkmark beside the items below, close all windows and click fix checked

O4 - HKLM\..\Run: [Ms Network Services] swchst.exe
O4 - HKLM\..\RunServices: [Ms Network Services] swchst.exe
————————————-
reboot once, then do a online scan or two at one of these, i know you already did one, try another;
BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php
check AutoClean under Scan Options.

Panda ActiveScan
http://www.pandasoftware.com/products/acti…CACHEHINT=Guest

Kaspersky virus scanner
http://www.kaspersky.com/virusscanner

Housecall at TrendMicro
http://housecall.trendmicro.com/housecall/start_corp.asp
check Auto Clean.

F-Secure virus scanner
http://support.f-secure.com/enu/home/ols.shtml


eTrust Antivirus Web Scanner
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
——————————————–
rescan and post another hjt log…………..shelf life
Post #3
Thanks shelf life for your time & reply.

Here's the results:

TrendMicro- Clean

Bit defender:
Identified Viruses2

Infected Files2

Suspect Files0

Warnings0

Disinfected0

Deleted Files2
C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)=>tsmart.exeInfected with: Trojan.Proxy.Ranky.EX

C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)=>tsmart.exe
Disinfection failed

C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)=>tsmart.exe
Deleted

C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)
Update failed

C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)=>youtak.exe
Infected with: Backdoor.SDBot.DAF32B62

C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)=>youtak.exe
Deleted

C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o)
Update failed







Logfile of HijackThis v1.99.1
Scan saved at 10:17:24 AM, on 6/14/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: PokerTime Poker - {7220F1C9-B7E0-47a6-A0BD-D5B3940BCC79} - C:\Program Files\PokerTimeMPP\MPPoker.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1127234437657
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1130783669870
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #4 last edited
didn't want to "Bump" My edit option is gone, so I had to add a reply. I'm sure you'll advise a few things, but.. Wanted to get this down(Getting old lol) in case you could aide with this, after we, errr you mainly have time after: Currently I have the recommended ctr-alt-delete to activate/log-on set… How beneficial is having user accounts(IE: Admin & 1 acct. for day-day) and have them password protected? Is there anyway I can mess up doing this now? Since my router worked fine up until this bug, Should I uninstall then reinstall my tcp/ip, could it have been comprimised by the trojan? Will this bug keep trying to exploit whatever/however it got in? Thanks again, George
Post #5
hi,

that log looks ok, i see those 2 04 items are gone now.


Since my router worked fine up until this bug, Should I uninstall then reinstall my tcp/ip, could it have been comprimised by the trojan?


if you can get online then tcp/ip is ok, i would try a 'reset" of the router . should be somewhere in the routers web page, check documentation or see link:
http://www.linksys.com/servlet/Satellite?c…FVisitorWrapper



How beneficial is having user accounts(IE: Admin & 1 acct. for day-day)
and have them password protected? Is there anyway I can mess up doing this now


cant offer much on that to be honest, i use a admin acct with password all the time, but iam the only one on this computer. if other people use the computer and your worried about them maybe downloading something then you could create a account/password for them with limited rights
start>settings>control panel>users and passwords>select "guest" then click on propereties>group membership to see restriction options for other users which you could create.

Will this bug keep trying to exploit whatever/however it got in

it only exploits when its on your computer, yours is gone.

shelf life
Post #6
OK kind sir!! I will try to re-hook my router, and see which of these programs I should disable(After reading your posted guides) as ewido, etal are zapping ALOT of resources. Then do some tests to see where/If my system is vulnerable. I will stick around this wealth of knowledge to stay abreast on malware, and general tips, etc. Perhaps I can one day add a helpfull answer. Once again…MANY THANKS!!
Post #7
that was fast, look if your router has a built in firewall, enable it. iam not aware of any trojan that will porposely "kill" a router, after all they want to use your connection. try that reset of the router, poke around the linksys web site also. shelf life
Post #8
Got it ;) this post was made WITH router attatched after 20min or so. It seems some settings were amiss(Powerful trojan?) or coincidence? anyway reset evrything to factory defaults re-installed and we're up. Dontcha just love the unexplainable faults and fixes :) Normally I would dig, but after the week I had….Well, I'll add it to the rainy day "Eventual Learn" list. Afterall shouldnt "Something/Anything" work right from the box without having to become a field expert on that device, etc..lololol Thanks again Shelf life. -George
Post #9 last edited
Still running, had a minor ZA "Shutdown error" but seems ok now. For reference: C:\Documents and Settings\Administrator\.housecall\Quarantine\wvista.exe.bac_a00968=>(Quarantine-4)=>(RAR Sfx o) Update failed Time permiting, One(Maybe 2-3) other things…do I need to clean those quarantined ^above^ files trend micro made, or is it ok? I have read where Zone Alarm can be a bugger at times, and a real bugger to remove *sighs* Will I have to do anything special once Zone alarm, and Ewido's "Trial" expires? Is a purchased ZA better, more stable, than their freeware version? Just so I know… Since I thought I took all, or a great amount of precautions..I'm kindof paranoid now. I've read & implemented a great deal of your MB sticky posted "Safety" advice Most virus's seem to be detected, but AFTER they're in and not removed. Is the proper action>quarantine>then run the removers? Thanks Again, If this would be better in the open forum LMK and I'll post there. -George
Post #10
hi ItsGeorge,

do I need to clean those quarantined

yes you can delete any file(s) quarantined by your av. when they are quarantined there not a threat, its like there "in jail"

Ewido's "Trial" expires

keep it if you want, it becomes a limited version after 14days, can still update it.

Is a purchased ZA better, more stable, than their freeware version?

the free version is fine, the purchased version comes with more add-ons, i would keep the free version.
if your router has a firewall or SPI, (stateful packet inspection) i would enable it

but AFTER they're in and not removed. Is the proper action>quarantine>then run the removers?

your antivirus is running all the time in the backround, so anyhting it flags will be quarantined. you can delete the quarantined files. if your av flags something, its a good idea to do a online scan, just for another check at one of these below. AV are good for virus and certain trojans. anti-trojans apps like ewido help to fill in the gap.

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php
check AutoClean under Scan Options.

Panda ActiveScan
http://www.pandasoftware.com/products/acti…CACHEHINT=Guest

Kaspersky virus scanner
http://www.kaspersky.com/virusscanner

Housecall at TrendMicro
http://housecall.trendmicro.com/housecall/start_corp.asp
check Auto Clean.

F-Secure virus scanner
http://support.f-secure.com/enu/home/ols.shtml


eTrust Antivirus Web Scanner
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx



shelf life
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI