I know this is...

jtb5150 · #1 04-30-2004, 04:27 PM

probably a stupid question..but..i just went through getting rid of a trojan on my PC...I ran spybot...ad-aware...nothing showing up...but...Interenet explorer still opens up when i have it closed..and when i boot up...it stays at the welcome screen ALOT longer that it did before all of this mess....any ideas or help????

Thanks

Azn_tweaker · #2 04-30-2004, 04:43 PM

Can u Name the Trojan?

jtb5150 · #3 04-30-2004, 04:49 PM

someone would ask...I deleted it from the list....I cant remember what it was...I got it by accidently installing a plug-in...one of those pop-up deals...

Azn_tweaker · #4 04-30-2004, 05:23 PM

delelted it with NAV?

jtb5150 · #5 04-30-2004, 05:48 PM

pc-cillin caught...then i deleted it..somebody...this thing is driving me nuts!

Azn_tweaker · #6 04-30-2004, 10:33 PM

the online scanner?

jtb5150 · #7 05-01-2004, 06:54 AM

No..I have the software installed

jtb5150 · #8 05-01-2004, 11:20 AM

now it boots up ok now..but...for some reason I can have IE closed and it opens up by itself to some web page...any ideas?

braindead · #9 05-01-2004, 12:16 PM

Sounds like you have one of those home page hijackers. If you can give us the home page it sends you to we can direct you to the removal of it.

Azn_tweaker · #10 05-01-2004, 02:09 PM

do an "Full Scan" with ad-aware and post ur log.
heres how to do an full scan: http://www.lavahelp.com/howto/fullscan/index.html

jtb5150 · #11 05-01-2004, 02:55 PM

sorry....hit the new thread thing...heres one of them....http://66.33.0.35/spyblocs/adv/tdw17.html

ironic its for spyware???

i will post the scan results in a little bit

Thanks

jtb5150 · #12 05-01-2004, 02:58 PM

Deep scanning and examining files (G

¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Tracking Cookie Object recognized!
Type : File
Data : jason@0[2].txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Cookies\

Created on : 5/1/2004 5:35:13 PM
Last accessed : 5/1/2004 5:35:13 PM
Last modified : 5/1/2004 5:35:13 PM

Tracking Cookie Object recognized!
Type : File
Data : jason@atdmt[2].txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Cookies\

Created on : 5/1/2004 4:23:48 PM
Last accessed : 5/1/2004 5:40:58 PM
Last modified : 5/1/2004 4:23:48 PM

Tracking Cookie Object recognized!
Type : File
Data : jason@z1.adserver[1].txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Cookies\

Created on : 5/1/2004 5:35:13 PM
Last accessed : 5/1/2004 5:35:13 PM
Last modified : 5/1/2004 5:35:13 PM

BargainBuddy Object recognized!
Type : File
Data : bb.exe
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 225 KB
Created on : 4/30/2004 1:23:06 PM
Last accessed : 5/1/2004 6:25:30 PM
Last modified : 4/30/2004 1:23:13 PM

Virtumundo Object recognized!
Type : File
Data : cidrules.dll
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 108 KB
FileVersion : 0, 402, 23, 1953
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
CompanyName : Virtumundo, Inc.
FileDescription : cidrules
InternalName : cidrules
OriginalFilename : cidrules.dll
ProductName : Virtumundo, Inc. cidrules
Created on : 4/30/2004 1:26:45 PM
Last accessed : 5/1/2004 6:25:30 PM
Last modified : 4/30/2004 1:26:47 PM

istbar Object recognized!
Type : File
Data : idl5659.exe
Category : Malware
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 56 KB
Created on : 4/30/2004 1:22:57 PM
Last accessed : 5/1/2004 6:25:32 PM
Last modified : 4/30/2004 1:22:59 PM

ClickSpring Object recognized!
Type : File
Data : ps5646.exe
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 105 KB
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
Copyright : Copyright (C) 2002
FileDescription : sear1 MFC Application
InternalName : sear1
OriginalFilename : sear1.EXE
ProductName : sear1 Application
Created on : 4/30/2004 1:22:53 PM
Last accessed : 5/1/2004 6:25:33 PM
Last modified : 4/30/2004 1:22:56 PM

BargainBuddy Object recognized!
Type : File
Data : shortcuts.txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 6 KB
Created on : 4/30/2004 1:24:26 PM
Last accessed : 5/1/2004 6:25:33 PM
Last modified : 4/30/2004 1:24:26 PM

Virtumundo Object recognized!
Type : File
Data : wincore.dll
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 184 KB
FileVersion : 0, 403, 19, 1928
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
InternalName : wincore.dll
OriginalFilename : wincore.dll
ProductName : TargetSoft
Created on : 4/30/2004 1:26:43 PM
Last accessed : 5/1/2004 6:25:38 PM
Last modified : 4/30/2004 1:26:45 PM

VX2.BetterInternet Object recognized!
Type : File
Data : appwrap[1].exe
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temporary Internet Files\Content.IE5\WLYZO1IJ\
FileSize : 22 KB
FileVersion : 1, 0
ProductVersion : 1, 0
Copyright : Copyright 2003
CompanyName : BundleWare.com
FileDescription : BundleWare.com
InternalName : BundleWare.com
OriginalFilename : BundleWare.com
ProductName : BundleWare.com
Created on : 4/30/2004 3:14:28 PM
Last accessed : 5/1/2004 6:25:50 PM
Last modified : 4/30/2004 3:14:29 PM

VX2.BetterInternet Object recognized!
Type : File
Data : axmparse.cpy.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 301 KB
Created on : 4/30/2004 1:23:23 PM
Last accessed : 5/1/2004 6:45:11 PM
Last modified : 4/30/2004 1:23:16 PM

VX2.BetterInternet Object recognized!
Type : File
Data : axmparse.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 301 KB
Created on : 4/30/2004 1:23:16 PM
Last accessed : 5/1/2004 6:45:11 PM
Last modified : 4/30/2004 1:23:16 PM

Virtumundo Object recognized!
Type : File
Data : cidrules.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 108 KB
FileVersion : 0, 402, 23, 1953
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
CompanyName : Virtumundo, Inc.
FileDescription : cidrules
InternalName : cidrules
OriginalFilename : cidrules.dll
ProductName : Virtumundo, Inc. cidrules
Created on : 4/30/2004 1:26:47 PM
Last accessed : 5/1/2004 6:45:17 PM
Last modified : 4/30/2004 1:26:47 PM

IGetNet Object recognized!
Type : File
Data : nlnp700.exe
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 110 KB
FileVersion : 5, 0, 0, 4
ProductVersion : 5, 0, 0, 4
Copyright : Copyright 2002
CompanyName : iGetNet, LLC
FileDescription : NLNinstall
InternalName : NLNinstall
OriginalFilename : NLNinstall.exe
ProductName : iGetNet, LLC - NLNinstall
Created on : 4/30/2004 1:23:06 PM
Last accessed : 5/1/2004 6:46:45 PM
Last modified : 4/30/2004 1:23:06 PM

Virtumundo Object recognized!
Type : File
Data : wincore.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 184 KB
FileVersion : 0, 403, 19, 1928
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
InternalName : wincore.dll
OriginalFilename : wincore.dll
ProductName : TargetSoft
Created on : 4/30/2004 1:26:45 PM
Last accessed : 5/1/2004 6:47:51 PM
Last modified : 4/30/2004 1:26:45 PM

Virtumundo Object recognized!
Type : File
Data : winhost32.exe
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 96 KB
FileVersion : 0, 310, 14, 1115
ProductVersion : 1, 0, 0, 0
OriginalFilename : winhost32.exe
ProductName : TargetSoft
Created on : 4/30/2004 1:26:43 PM
Last accessed : 5/1/2004 6:47:51 PM
Last modified : 4/30/2004 1:26:43 PM

Virtumundo Object recognized!
Type : File
Data : winupd.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 152 KB
FileVersion : 0, 403, 29, 1730
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
InternalName : winupd.dll
ProductName : TargetSoft
Created on : 4/30/2004 1:26:31 PM
Last accessed : 5/1/2004 6:47:53 PM
Last modified : 4/30/2004 1:26:33 PM

Disk scan result for G:\
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 17

2:48:11 PM Scan complete

Summary of this scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Total scanning time :00:24:13:580
Objects scanned :55364
Objects identified :17
Objects ignored :0
New objects :17

Azn_tweaker · #13 05-01-2004, 04:10 PM

Post the whole log please.

Azn_tweaker · #14 05-01-2004, 04:14 PM

Quote:

Originally posted by jtb5150
Deep scanning and examining files (G
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Tracking Cookie Object recognized!
Type : File
Data : jason@0[2].txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Cookies\

Created on : 5/1/2004 5:35:13 PM
Last accessed : 5/1/2004 5:35:13 PM
Last modified : 5/1/2004 5:35:13 PM

Tracking Cookie Object recognized!
Type : File
Data : jason@atdmt[2].txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Cookies\

Created on : 5/1/2004 4:23:48 PM
Last accessed : 5/1/2004 5:40:58 PM
Last modified : 5/1/2004 4:23:48 PM

Tracking Cookie Object recognized!
Type : File
Data : jason@z1.adserver[1].txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Cookies\

Created on : 5/1/2004 5:35:13 PM
Last accessed : 5/1/2004 5:35:13 PM
Last modified : 5/1/2004 5:35:13 PM

BargainBuddy Object recognized!
Type : File
Data : bb.exe
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 225 KB
Created on : 4/30/2004 1:23:06 PM
Last accessed : 5/1/2004 6:25:30 PM
Last modified : 4/30/2004 1:23:13 PM

Virtumundo Object recognized!
Type : File
Data : cidrules.dll
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 108 KB
FileVersion : 0, 402, 23, 1953
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
CompanyName : Virtumundo, Inc.
FileDescription : cidrules
InternalName : cidrules
OriginalFilename : cidrules.dll
ProductName : Virtumundo, Inc. cidrules
Created on : 4/30/2004 1:26:45 PM
Last accessed : 5/1/2004 6:25:30 PM
Last modified : 4/30/2004 1:26:47 PM

istbar Object recognized!
Type : File
Data : idl5659.exe
Category : Malware
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 56 KB
Created on : 4/30/2004 1:22:57 PM
Last accessed : 5/1/2004 6:25:32 PM
Last modified : 4/30/2004 1:22:59 PM

ClickSpring Object recognized!
Type : File
Data : ps5646.exe
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 105 KB
FileVersion : 1, 0, 0, 1
ProductVersion : 1, 0, 0, 1
Copyright : Copyright (C) 2002
FileDescription : sear1 MFC Application
InternalName : sear1
OriginalFilename : sear1.EXE
ProductName : sear1 Application
Created on : 4/30/2004 1:22:53 PM
Last accessed : 5/1/2004 6:25:33 PM
Last modified : 4/30/2004 1:22:56 PM

BargainBuddy Object recognized!
Type : File
Data : shortcuts.txt
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 6 KB
Created on : 4/30/2004 1:24:26 PM
Last accessed : 5/1/2004 6:25:33 PM
Last modified : 4/30/2004 1:24:26 PM

Virtumundo Object recognized!
Type : File
Data : wincore.dll
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temp\
FileSize : 184 KB
FileVersion : 0, 403, 19, 1928
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
InternalName : wincore.dll
OriginalFilename : wincore.dll
ProductName : TargetSoft
Created on : 4/30/2004 1:26:43 PM
Last accessed : 5/1/2004 6:25:38 PM
Last modified : 4/30/2004 1:26:45 PM

VX2.BetterInternet Object recognized!
Type : File
Data : appwrap[1].exe
Category : Data Miner
Comment :
Object : G:\Documents and Settings\Jason\Local Settings\Temporary Internet Files\Content.IE5\WLYZO1IJ\
FileSize : 22 KB
FileVersion : 1, 0
ProductVersion : 1, 0
Copyright : Copyright 2003
CompanyName : BundleWare.com
FileDescription : BundleWare.com
InternalName : BundleWare.com
OriginalFilename : BundleWare.com
ProductName : BundleWare.com
Created on : 4/30/2004 3:14:28 PM
Last accessed : 5/1/2004 6:25:50 PM
Last modified : 4/30/2004 3:14:29 PM

VX2.BetterInternet Object recognized!
Type : File
Data : axmparse.cpy.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 301 KB
Created on : 4/30/2004 1:23:23 PM
Last accessed : 5/1/2004 6:45:11 PM
Last modified : 4/30/2004 1:23:16 PM

VX2.BetterInternet Object recognized!
Type : File
Data : axmparse.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 301 KB
Created on : 4/30/2004 1:23:16 PM
Last accessed : 5/1/2004 6:45:11 PM
Last modified : 4/30/2004 1:23:16 PM

Virtumundo Object recognized!
Type : File
Data : cidrules.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 108 KB
FileVersion : 0, 402, 23, 1953
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
CompanyName : Virtumundo, Inc.
FileDescription : cidrules
InternalName : cidrules
OriginalFilename : cidrules.dll
ProductName : Virtumundo, Inc. cidrules
Created on : 4/30/2004 1:26:47 PM
Last accessed : 5/1/2004 6:45:17 PM
Last modified : 4/30/2004 1:26:47 PM

IGetNet Object recognized!
Type : File
Data : nlnp700.exe
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 110 KB
FileVersion : 5, 0, 0, 4
ProductVersion : 5, 0, 0, 4
Copyright : Copyright 2002
CompanyName : iGetNet, LLC
FileDescription : NLNinstall
InternalName : NLNinstall
OriginalFilename : NLNinstall.exe
ProductName : iGetNet, LLC - NLNinstall
Created on : 4/30/2004 1:23:06 PM
Last accessed : 5/1/2004 6:46:45 PM
Last modified : 4/30/2004 1:23:06 PM

Virtumundo Object recognized!
Type : File
Data : wincore.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 184 KB
FileVersion : 0, 403, 19, 1928
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
InternalName : wincore.dll
OriginalFilename : wincore.dll
ProductName : TargetSoft
Created on : 4/30/2004 1:26:45 PM
Last accessed : 5/1/2004 6:47:51 PM
Last modified : 4/30/2004 1:26:45 PM

Virtumundo Object recognized!
Type : File
Data : winhost32.exe
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 96 KB
FileVersion : 0, 310, 14, 1115
ProductVersion : 1, 0, 0, 0
OriginalFilename : winhost32.exe
ProductName : TargetSoft
Created on : 4/30/2004 1:26:43 PM
Last accessed : 5/1/2004 6:47:51 PM
Last modified : 4/30/2004 1:26:43 PM

Virtumundo Object recognized!
Type : File
Data : winupd.dll
Category : Data Miner
Comment :
Object : G:\WINDOWS\system32\
FileSize : 152 KB
FileVersion : 0, 403, 29, 1730
ProductVersion : 1, 1, 0, 0
Copyright : Copyright 2003
InternalName : winupd.dll
ProductName : TargetSoft
Created on : 4/30/2004 1:26:31 PM
Last accessed : 5/1/2004 6:47:53 PM
Last modified : 4/30/2004 1:26:33 PM

Disk scan result for G:\
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 17

2:48:11 PM Scan complete

Summary of this scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Total scanning time :00:24:13:580
Objects scanned :55364
Objects identified :17
Objects ignored :0
New objects :17

__________________________________________________ _
for cidrules.dll
look here: http://www.pestpatrol.com/PestInfo/v/virtumonde.asp

jtb5150 · #15 05-02-2004, 05:18 AM

Now....I ran ad-aware again..and it still found something...that virtumondo...whatever its called....it found it in the xircom folder????which has nothing in it when I went there...anyway.....I have DSL, and it wont even try and connect...I mean...i can open up firefox...and it says immeadiatly it cant find that page.....doesnt even try and look for my home page. now what????BTW..I have 2 hard drives....thats how I was able to get back on the net.