Welcome, Guest. Please Login or Register.
Search
Members
Login
Register
   Mischel Internet Security Forum
   Malware
   Trojans (Moderators: Helena, Gavin_Coe, Magnus)
   trojan-clicker.js.agent.h		 « Previous topic | Next topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: trojan-clicker.js.agent.h  (Read 6345 times)
deadmoney
Newbie
*





   


Posts: 2
trojan-clicker.js.agent.h
« on: Aug 31st, 2007, 9:14am »		 Quote Quote  Modify Modify
Hello,
 
 
The above "Virus" was caught by ZASS (zone Alarm security suite) but I was wondering if you guys have any knowledge of this, it keeps reappearing and I have about 7 quarantined?
 
any idea is advice is appreciated
 
 
Regards David
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 7358
Re: trojan-clicker.js.agent.h
« Reply #1 on: Aug 31st, 2007, 9:23am »		 Quote Quote  Modify Modify
Welcome to the forum deadmoney,  Cheesy
 
There are multiple variants of this malicious elements.  Because of the lack of a universal/global naming convention between security software, it is not possible to state positively which variant you have.
 
I recommend that you download/install the trial version of TH and let's see if we can assist you in getting rid of it permanently.
 
Also, please install HiJackthis on your system and post a HJT log back here so we can see what is on your system.  The link below provides the download link for HJT.
 
http://www.misec.net/forum/board/FAQ/1163329424
IP Logged
______
TrojanHunter V5.5.1002...No. 1 AT in my Book and on my Box(es)! Windows 7 x64 Professional on a Dell XPS 410, 8 gbyte RAM, dual WD VelociRaptors, dual 24" UltraSharp FPD monitors, Logitech 5.1 Surround Sound; Windows 7 x86 Professional on a Dell Vostro 220s, 4 gbyte RAM, dual WD VelociRaptors. Common: router, cable modem.
deadmoney
Newbie
*





   


Posts: 2
Re: trojan-clicker.js.agent.h
« Reply #2 on: Aug 31st, 2007, 9:38am »		 Quote Quote  Modify Modify
My Bad, I am sorry
 
I have TH and have had it for a number of years and am a strong advocate (I routinely do deep scans as It has caught a trojan but NOT on the quick scan method)
 
This kinda brings me to my other question, why is NOT TH cathcing and cleaning it ? or is it just a case of ZASS "getting to it first"?
 
Thanks regards David
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 7358
Re: trojan-clicker.js.agent.h
« Reply #3 on: Aug 31st, 2007, 9:59am »		 Quote Quote  Modify Modify
It could very well be the "first detect - first to scream" issue, yes.  The fact that it keeps returning, however, typically means that it is not being fully cleaned out by the "detector".  A Hijackthis log might help us to identify something left behind.
 
Does the ZoneAlarm Quarantine identify what files are quarantined?
« Last Edit: Aug 31st, 2007, 10:01am by siliconman01 » IP Logged
______
TrojanHunter V5.5.1002...No. 1 AT in my Book and on my Box(es)! Windows 7 x64 Professional on a Dell XPS 410, 8 gbyte RAM, dual WD VelociRaptors, dual 24" UltraSharp FPD monitors, Logitech 5.1 Surround Sound; Windows 7 x86 Professional on a Dell Vostro 220s, 4 gbyte RAM, dual WD VelociRaptors. Common: router, cable modem.
pckiwi
Newbie
*





   


Posts: 1
Re: trojan-clicker.js.agent.h
« Reply #4 on: Sep 30th, 2007, 6:25pm »		 Quote Quote  Modify Modify
I have an interesting situation with the this trojon. It is detected by Kaspersky Internet Suite when i  visit one particular webpage.  This is a ligimat company webpage i use all the time for business use.  It doesnt show on any other pages ive visited. The particular page has been viewed by other machines running macafee , and another running ZASS which didnt detect anything.  ive scanned my computer which is a compaq presario f500 runing vista home edition. I have run HJT and have the log. as soon as as i work out how to post it i will.  
 
Detected
--------
StatusObject
------------
detected: Trojan program Trojan-Clicker.JS.Agent.hURL: http://www.zcom.co.nz/
 
 
any help would be apreciated
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 7358
Re: trojan-clicker.js.agent.h
« Reply #5 on: Oct 1st, 2007, 12:52am »		 Quote Quote  Modify Modify
Welcome to the forum pckiwi  Wink
 
I suspect that Kaspersky is seeing the ActiveX element that is downloading or trying to download when you visit that webpage.  
 
To post the HJT log, run a "system scan and save logfile".  The logfile will be open at the end of the scan.  Just do a
 
-  select all to highlight the entire file contents.  (ctrl-A)
-  Copy the contents (ctrl-C)
-  Paste the log into a new post on this forum thread (ctrl-V)
IP Logged
______
TrojanHunter V5.5.1002...No. 1 AT in my Book and on my Box(es)! Windows 7 x64 Professional on a Dell XPS 410, 8 gbyte RAM, dual WD VelociRaptors, dual 24" UltraSharp FPD monitors, Logitech 5.1 Surround Sound; Windows 7 x86 Professional on a Dell Vostro 220s, 4 gbyte RAM, dual WD VelociRaptors. Common: router, cable modem.
Nonne
Newbie
*





   


Posts: 3
Re: trojan-clicker.js.agent.h
« Reply #6 on: Mar 10th, 2008, 1:14am »		 Quote Quote  Modify Modify
ZoneAlarm found this trojan a couple of days ago and it seems like a lot of our pages have been infected via our server. This is what we found when looking in the page source:
 
<script language='javascript' src='http://127.0.0.1:1025/js.cgi?a&r=41'></script>
 
We have removed this script and changed passwords, and now ZoneAlarm does not react any more but, and this is what I do not understand, the script is still there when starting the browser in my computer, and only my computer. And today I found one page that we had missed when removing script and in my computer it was not  possible to view page source. I use Firefox but also tried it in IE.
 
Anyone who knows how to get rid of this trojan?
 
Nonne
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 7358
Re: trojan-clicker.js.agent.h
« Reply #7 on: Mar 10th, 2008, 1:27am »		 Quote Quote  Modify Modify
Welcome to the forum Nonne,  Wink
 
Would you please post a HiJackthis scan log so I can see what is on your system.  The link below describes how to install HJT.
 
http://www.misec.net/forum/board/FAQ/1163329424
IP Logged
______
TrojanHunter V5.5.1002...No. 1 AT in my Book and on my Box(es)! Windows 7 x64 Professional on a Dell XPS 410, 8 gbyte RAM, dual WD VelociRaptors, dual 24" UltraSharp FPD monitors, Logitech 5.1 Surround Sound; Windows 7 x86 Professional on a Dell Vostro 220s, 4 gbyte RAM, dual WD VelociRaptors. Common: router, cable modem.
Nonne
Newbie
*





   


Posts: 3
Re: trojan-clicker.js.agent.h
« Reply #8 on: Mar 10th, 2008, 2:29am »		 Quote Quote  Modify Modify
Thanks siliconman01. I will start downloading now. Will come back later.
IP Logged
Nonne
Newbie
*





   


Posts: 3
Re: trojan-clicker.js.agent.h
« Reply #9 on: Mar 12th, 2008, 11:46am »		 Quote Quote  Modify Modify
WinkI have got rid of this trojan. It really was difficult, but at last it is gone. Thanks for your help.  
 
Nonne
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 7358
Re: trojan-clicker.js.agent.h
« Reply #10 on: Mar 12th, 2008, 12:24pm »		 Quote Quote  Modify Modify
Glad to hear that you are cleaned up.  U R most welcome...although we didn't do anything.  Smiley
IP Logged
______
TrojanHunter V5.5.1002...No. 1 AT in my Book and on my Box(es)! Windows 7 x64 Professional on a Dell XPS 410, 8 gbyte RAM, dual WD VelociRaptors, dual 24" UltraSharp FPD monitors, Logitech 5.1 Surround Sound; Windows 7 x86 Professional on a Dell Vostro 220s, 4 gbyte RAM, dual WD VelociRaptors. Common: router, cable modem.
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »