PDA

View Full Version : please help this new trojan is killing me.



amitabhverma8
2008-06-27, 14:18
please help this new trojan is killing me.


i have norton internet security suite 2003 my computer has windows xp professional with sp2. . i also have adaware se professional, adaware 2007 with adwatch. spybot search and destroy, pest patrol, windows defender mcafee antivirus 8.5i enterprise edition, webroot spy sweeper, spyware blaster, i have also scanned through online bitdefender, F-secure, and sophos and you name it may be i have gone through it. i think the problem started when my brother downloaded some swf file or may be i downlaoded some video codec for quicktime requested by wikipedia website to view ogg file in the browser. i dont know what it is. oh yeah one more thing i have noticed that this thing comes up when i am connected to network i mean when ever my broadband is off the norton stops giving message or if i clean my disk using disk cleanup utility this guy dosent load for 5 to 7 minutes till i start my broadband and then it keeps loading and loading and loading the norton antivirus detects it and then quarantines it then detects and quarantines. it keeps going on every 6 to 7 seconds

since yesterday the norton antivirus is detecting trojan.adcliker when is clicked on the

link it takes me to this link http://www.sarc.com/avcenter/cgi-bin/virauto.cgi?vid=34860. i

have tried the whole process explained in the removal. but it is not working i have just now

exported the quarantine list file i am gonna going to post the whole detail. in every 4 to 5

seconds these two files keep loading update.gif[1] and c:\windows\temp\qq_update.cab these

two files keep

loading i down know and in the norton backup files in quaratine it it is now upto 17212

files collected. i dont know what to do please help me i am just going nuts here are the details of the file and images. one more thing this mcafee keep giving this message. please look at the images file i am giving you the photobucket link it has 5 images with all the views of problem thank you


http://i162.photobucket.com/albums/t253/amitabhverma8/trojan1imagedescription5.jpg
http://i162.photobucket.com/albums/t253/amitabhverma8/trojan1imagedescription4.jpg
http://i162.photobucket.com/albums/t253/amitabhverma8/trojan1imagedescription3.jpg
http://i162.photobucket.com/albums/t253/amitabhverma8/trojan1imagedescription2.jpg
http://i162.photobucket.com/albums/t253/amitabhverma8/trojan1imagedescription.jpg




here is the small information i have found. on

both the problem the norton and mcafee.

http://www.fortiguardcenter.com/VirusEncyclopedia/search/encyclopediaSearch.do?method=quickSearchDirectly&virusName=W32/Murlo.NN!tr.dldr

http://www.google.com/search?hl=en&q=vbs.psyme

http://vil.nai.com/vil/content/v_100749.htm

http://www.google.com/search?hl=en&q=qq_update.cab&btnG=Search



:spider:PLEASE HELP ME RECTIFY THIS PROBLEM


Norton AntiVirus Quarantine Report
Created: Friday, June 27, 2008 12:28:39 PM
------------------------------------------------------------------------------

File Name
Location
Status Size Virus Name
User Name Machine Name Domain
Date Quarantined
Date Submitted





------------------------------------------------------------------------------

QQ_Update.cabC:\WINDOWS\TEMP
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:56:45 AM
Not submitted

------------------------------------------------------------------------------

update[1].gifC:\Documents and Settings\Administrator\Local Settings\Temporary Internet

Files\Content.IE5\2CIB25UL
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:52:38 AM
Not submitted

------------------------------------------------------------------------------

QQ_Update.cabC:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:51:07 AM
Not submitted

------------------------------------------------------------------------------

QQ_Update.cab
C:\WINDOWS\TEMP
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:27:50 AM
Not submitted

------------------------------------------------------------------------------

update[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet

Files\Content.IE5\2CIB25UL
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:27:38 AM
Not submitted

------------------------------------------------------------------------------

QQ_Update.cab
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:09:20 AM
Not submitted

------------------------------------------------------------------------------

update[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet

Files\Content.IE5\749CUK85
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:09:13 AM
Not submitted

------------------------------------------------------------------------------

update[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet

Files\Content.IE5\2CIB25UL
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:06:53 AM
Not submitted

------------------------------------------------------------------------------

QQ_Update.cab
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 11:06:08 AM
Not submitted

------------------------------------------------------------------------------

QQ_Update.cab
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 10:51:46 AM
Not submitted

------------------------------------------------------------------------------

update[1].gif
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet

Files\Content.IE5\749CUK85
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 10:47:25 AM
Not submitted

------------------------------------------------------------------------------

QQ_Update.cab
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 10:45:54 AM
Not submitted

------------------------------------------------------------------------------

3BC269D5.TMP
C:\PROGRAM FILES\NORTON ANTIVIRUS\QUARANTINE\PORTAL
Backup 9.51 KB Trojan.Adclicker
SYSTEM NEWCOMP MSHOME
Friday, June 27, 2008 10:43:50 AM

ken545
2008-06-27, 15:56
Hello amitabhverma8

Welcome to Safer Networking.

Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
That said, All advice given by anyone volunteering here, is taken at own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.

Download Trendmicros Hijackthis (http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe) to your desktop.
Double click it to install
Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe

Open HJT Scan and Save a Log File, it will open in Notepad
Go to Format and make sure Wordwrap is Unchecked
Go to Edit> Select All.....Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.

DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.