Do you think this is a virus/worm/trojan?

fishman · Dec 7, 2004

So did you ever get your problem fixed? Four days ago a Trojan got on my computer and Norton acts like it's not even there. Whenever I get on the internet, a bunch of programs install, and I get unwanted popups like crazy.

Maybe somebody could recommend an aftermarket "Trojan Killer" program? After spending several hours trying to fix the problem, I'm ready to pull out my hair. /forums/images/graemlins/mad.gif

Junkman · Dec 7, 2004

If you are using Windows XP, ME, or 2000, I believe that you have to turn off the RESTORE feature before using any virus removal tool. I had one a couple of years ago and once I learned this, I was able to get rid of it the first try. Before that, it kept coming back as a result of the restore feature.

DocHeb · Dec 7, 2004

Luckily I found the email "spoof" and knew enough to not open the attachments. I don't think my wife would have been so lucky. I didn't suffer any problems.

I have submitted the attachments to Norton via SARCET - possible virus submission software, but haven't heard back as of yet.

Alan L. · Dec 8, 2004

I think a bunch of messages are being sent from elsewhere using your email address as the "from". Our mailserver at work came to its knees one day a couple of months ago because it was receiving about 2 or 3 rejection messages per second, with various names@our domain as the addressee. The problem was that the server was set to respond to each one to inform the sender that the email address did not exist in our domain. We tried various filters but they varied so much it was impossible to filter. So I simply told the mailserver software to reject any messages addressed to our domain for which there was not a valid address. The sender does not receive any reply, and the mail is not delivered to any mailbox. Problem solved.

I don' think you have a trojan on your computer.

GerardC · Dec 8, 2004

( If you are using Windows XP, ME, or 2000, I believe that you have to turn off the RESTORE feature before using any virus removal tool. I had one a couple of years ago and once I learned this, I was able to get rid of it the first try. Before that, it kept coming back as a result of the restore feature. )

You are absolutely correct Junkman. Gerard

fishman · Dec 8, 2004

Well I've done that, but once I link to the net, the computer slows noticeably and the folders/files are rebuilt in a few moments. Norton discovered the "Trojan Horse" in my daughter's email, but said that it failed in it's repair attempt. After that, it could not pick it up, but the problems continue. /forums/images/graemlins/confused.gif

fishman · Dec 10, 2004

Well, I think I solved my problem. I went out and bought a suite of programs from Webroot called "Internet Essentials" One of the programs was called "Spy Sweeper". Ran it once and it found my Trojan and 16 additional nasties. Ran it again in safe mode and got one more. That was about an hour ago. No problems at all since.

So far, I'm happy. Only cost me $70 to get some peace of mind. /forums/images/graemlins/frown.gif

sweettractors · Dec 11, 2004

I ran "Spy Sweeper" when I was trying to get rid of junk on the PC, however, a few days later I started getting my IE homepage hijacked and "Spy Sweeper" could pick it up and said it fixed the problem. The fix was only good for a few hours and then I had the same hijacked page problem. I called my ISP about this and they asked when I started to have the hijacked page problem. I told them, after I installed the "Spy Sweeper" from Webroot. He suggested That I uninstall it as it could be the cause of my problem. I did and I still have the problem, so now, I dont know what to try next /forums/images/graemlins/confused.gif--Ken Sweet

DocHeb · Dec 11, 2004

You are probably being "re-infected" from web sites you are going to. I'm still running Win98, so a WinXP person may be able to tell you the menu selections to tighten up cookie control (permit first party cookies, disable third party cookies) and privacy controls that may help.

I have had excellent results with Spybot Search and Destroy, as it allows you to "immunize" your system and prevent "re-infection". Find SS&D at Spybot, and download Search & Destroy 1.3, remembering to check for updates weekly and re-immunize your machine.

If your not running behind a router - get one.

DocHeb · Dec 11, 2004

I got my reply from Norton SARCET. As I suspected, the zip file does contain a virus:


Developer notes:
C:\WINDOWS\Desktop\Undelivered Mail Returned to Sender.eml This email message contains an attachment infected with a known worm. NAV does not detect the attachment until it is extracted from the mail message. You should delete this email message.

thats_hard.zip This archive contains malicious code. Any malicious contents will be detected by NAV if they are extracted from the archive. Please delete this file. This file is contained by C:\WINDOWS\Desktop\Undelivered Mail Returned to Sender.eml 

We have received no further bounced email, so I believe we were a random recipient, rather than having our machine taken over and used as a source.

He hopes. /forums/images/graemlins/frown.gif