Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Dec 1st, 2008, 8:41pm
   Mischel Internet Security Forum
   Malware
   Trojans (Moderators: Helena, Gavin_Coe, Magnus)
   i have the zlob.fc trojan how do i get rid of it!!		 « Previous topic | Next topic »
Pages: 1 2 3  ...  5 Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: i have the zlob.fc trojan how do i get rid of it!!  (Read 2110 times)
kanifeli
Newbie
*





   


Posts: 37
i have the zlob.fc trojan how do i get rid of it!!
« on: Feb 21st, 2007, 6:35pm »		 Quote Quote  Modify Modify
i got myself stupidly infected by the zlob.fc. none of my scanners picks it up and i am way over angry at it. i'm trying TH to see if it works but i need as much info as i can get in case it is not enough.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #1 on: Feb 22nd, 2007, 12:04am »		 Quote Quote  Modify Modify
Welcome to the forum kanifeli  Cheesy
 
Sorry to hear that you have become infected by the cybercriminals.  Please follow the procedure in the link below as initial steps.
 
http://www.misec.net/forum/board/FAQ/1170863449
 
Also, the trial version of TH requires a manual update of the rules/definitions.  The first update when you installed TH allowed you to run LiveUpdate; after that, the updates are manual (for the Trial version only).  Gavin updates the rules daily, so please run the manual update every day or so to obtain the latest rules.  
 
http://www.misec.net/trojanhunter/updating/
« Last Edit: Feb 22nd, 2007, 1:09am by siliconman01 » IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #2 on: Feb 22nd, 2007, 3:29am »		 Quote Quote  Modify Modify
thnx i am lucky that the avg detects the dlls it tries to install but no program i've tried yet detects the main thing. not in memmory not in file. hell the avg did not even detect it on the file that infected me, i scanned it before i ran it like i always do thats why i thought it was safe.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #3 on: Feb 22nd, 2007, 3:42am »		 Quote Quote  Modify Modify
Would you please submit the file that infected you to Mischel Internet Security for analysis.  The link below describes how to submit.
 
http://www.misec.net/forum/board/FAQ/1139308293
 
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #4 on: Feb 22nd, 2007, 4:04am »		 Quote Quote  Modify Modify
from what i can tell (me being new at this but still a systems engineer) it sets up a new rundll32 and a dll called something like yayyys.dll now i can block the yayyys temporarly bt i don't know which rundll32 i have to remove. i can't readyly submit it cause it deleted itself after execution. it did not even run. let me see if i can find it again for you.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #5 on: Feb 22nd, 2007, 4:10am »		 Quote Quote  Modify Modify
That sounds typical of the Zlob type infections.  You will need to do scans in SAFE MODE as described in the procedure I provided a link to before.  You should also try a scan with Dr. Web CureIt in SAFE MODE.  
 
http://www.freedrweb.com/cureit/
 
We need to see a HiJackthis log also in order to help determine the culprit.
« Last Edit: Feb 22nd, 2007, 4:11am by siliconman01 » IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #6 on: Feb 22nd, 2007, 4:15am »		 Quote Quote  Modify Modify
found it the mofo i renamed it so you know what it is and added it to the protected zipfile. i'll send it now.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #7 on: Feb 22nd, 2007, 4:20am »		 Quote Quote  Modify Modify
Hey, Thanks much for the submission.  Gavin will analyze it and incorporate the necessary rules in TH to assist in its removal.   Wink
 
However, you can do the SAFE MODE scans, etc., and post the requested logs while waiting for Gavin to analyze the critter.  
 
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #8 on: Feb 22nd, 2007, 4:23am »		 Quote Quote  Modify Modify
i'll have to send it later through my office email cause yahoo and google won't let me send it.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #9 on: Feb 22nd, 2007, 4:27am »		 Quote Quote  Modify Modify
Okay, understood.
 
I have to leave in about 30 minutes and will be out of pocket for about 6 hours.  However, if you can post logs, etc., I'll jump on it when I return.  Sorry about the delay.  Sad
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #10 on: Feb 22nd, 2007, 4:37am »		 Quote Quote  Modify Modify
i think i sent it. i used your server though to do it. sorry bout that. i took advantage of a mass email software i was testing at my job.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #11 on: Feb 22nd, 2007, 4:39am »		 Quote Quote  Modify Modify
Any port in the cybercriminal war!   Grin
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #12 on: Feb 22nd, 2007, 4:40am »		 Quote Quote  Modify Modify
Grin  
 
i'm gonna reboot now see if i can clean this mess.
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5815
Re: i have the zlob.fc trojan how do i get rid of
« Reply #13 on: Feb 22nd, 2007, 4:58am »		 Quote Quote  Modify Modify
Gotta head out for ~ 6 hours...be back around noon (eastern time, USA)  Wink
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
kanifeli
Newbie
*





   


Posts: 37
Re: i have the zlob.fc trojan how do i get rid of
« Reply #14 on: Feb 22nd, 2007, 7:04am »		 Quote Quote  Modify Modify
i'm at work now, my pc is in safe mode runnig the cureit though its going really slow. i hope it finds and kills that mofo.  
 
you guys ever consider doing a antivirus-spyware convension? if you do keep in mind Colombia as a posible location its cheap and i might be able to get you a hotel with good rates and the room to do it in. (so i work at a hotel) Wink
IP Logged
Pages: 1 2 3  ...  5 Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register