Jump to content
GreaseSpot Cafe

How can I tell if I have a Trojan horse or Worm?


Recommended Posts

I posted this question "upstairs" in my thread about my credit card hacker/internet theft.

How can I know if I have some sort of worm or trojan horse? Especially since I am hearing that Norton does not always catch these, nor Spybot, adaware, etc? I've run full scans and updates with both Norton and Spybot--including immunizing. I did that Friday night. I didn't run Adaware cuz I thought that is supposed to catch the same things Spybot did.

Link to comment
Share on other sites

Run both adaware (by lavasoft) and spybot search and destroy. Each looks for different exploits by crapware, keyloggers, and hijackers.

The way things are currently, unless you are a computer professional, it is very difficult for the average user to identify any malware they might have. Malware has become stealthy in hidding its self by changing names or places it resides.

I would suggest you go have a visit at

spywareinfo

Make a post in The spyware removal-Hijack forum with your problem. With the number of posts they recieve you may have to bump your post to the top of the list on occasion. Follow what the experts or helpers suggest, and ask for assistance to avoid getting reinfected.

I would walk you through this, but would rather have the resources of that site to be sure you get the best help possible.

(oh by the way proverb17 says he still has sackbutt envy, and still complains about Psalms before proverbs...)

Link to comment
Share on other sites

*** Psalm71one sees Apple/Proverb and squeals in delight! ***

So sorry yer still jealous of my lovely sackbutt, and the Psalms/Proverb thing!!!! icon_wink.gif;)--> butchaknow, these things happen! LOL!

And thanks for the advice about the spyware place, I will hit that site next.

I will go ahead and run Adaware, too-- I was wondering if I should delete it since I had gotten Spybot. I figured it was redundant!

I've been getting spam from someone that uses the same address, has an attachment, and gives a password in each email. (I don't open the mail, but Outlook Express opens it when i click on it to delete it) These emails started coming about the same time my debit/credit card # was used to make purchases I didn't authorize.

Link to comment
Share on other sites

I dunno if anybody will see this off-topic question here or if I'll need to start another thread.

I asked a bunch of questions in Open forums about weird emails and this "somebody is researching your background" site. MrPmosh recommended I switch my browser to Mozilla. I'd like to.

I still haven't done it cuz I might loose some stuff. Like will my favorites be saved? And did I understand that some places ya still have to use IE? and how much space is it gonna take? I have 529MB of space left? is that too little?

Where do I learn about all this?

Link to comment
Share on other sites

Great let me know under what Nick or handle you are posting over on spywareinfo. Better yet a link so I can baby sit your post should you not get a quick response.

Mozilla firefox is what you want to download.

About 6.5 megabytes. So you do have room for it.

Here is a link to it so you can learn all about it.

Firefox-Browser

Now with that said, I have not used it myself but come recomended highly by those who do just for the feature of tab browsing and ad blocking built in. No more continuing to back and forth and open new windows to follow links.

Why havent I used it? Just have not taken the time on a shared dial up to grab the file. One of those when I get around to it I will do it.

I have not have had problems with IE because of the security tweakings and layered applications I have running.

See you soon.

Link to comment
Share on other sites

A snip from a Tech/tv article for getting you IE favorites to Mozilla firefox.

Things to Know about Firefox

quote:

Import

Just because you change your browser doesn't mean you have to lose all of your Internet Explorer "Favorites." Here's how to transfer all those precious bookmarks:

1. Open Internet Explorer, then go to File and click on Import and Export.

2. Welcome to the Import/Export Wizard:

a. Click Next, highlight Export Favorites in the window, and click Next.

b. Choose the folder of Favorites you want to export ("Favorites," or one of its subfolders) and click Next.

c. Check the "Export to a File or Address" option and use the Browse button to choose where you want to save it. Click Next and Finish. You now have a single HTML file with all your Favorites links.

3. Fire up Mozilla, open Bookmarks, and then open Manage Bookmarks.

4. In the Manage Bookmarks window go to Tools and then Import.... Dig up the file you just exported from IE.

5. Select Open and your IE faves are now available in Mozilla!


There you go

Link to comment
Share on other sites

We've been talking security in the "Registry Keys" thread.

I'd skim the thread.

If you're worried you may have a virus of any kind, go to the

trendmicro link (or other online virus scanner) and scan your machine.

Pack a lunch-it can take an hour for a thorough scan.

I do that once a month, just in case. So far, always a clean bill of

health.

AdAware offers updates every few DAYS, so remember to update at least weekly.

I run the thing daily, sometimes more than once.

From what the local experts here say, using Linux over Windows, and

Mozilla/Firefox over IE, both increase your security. That's because

hackers write almost all their exploits and viruses and things to take

advantage of either Windows or Internet Explorer.(Some exploit Outlook

Express.) They'll have to tell you more about that.

Link to comment
Share on other sites

Thanks, guys about the Adaware info-- sheesh! I had no idea! (and don't say airheads like me shouldn't be usin the puter! icon_razz.gif:P--> ) I'll update it again!

I did look in my MSCONFIG thingy and there was good ole "Aveo"--checked to start up! aha! I thought I got rid of that! (and there's a buncha other stuff, too). Some Lexmark program was checked to run at startup and I got rid of that pain-in-the-hiney copier 6 months ago--thought I had uninstalled it, too!

I think a lot of stuff is coming in the games my boys play--they don't go online, but they get games from the library or frinds, etc. The Aveo thingy was on an educational cd and it WON'T GO AWAY!

Apple-pie-in-the-sky oops! er, Apple aday (I just HAVE to pick on ya!)

I'm still reading at spyware info. I read the faq's first. This doesn't sound like a hijack, but I did go to the HiJack tutorial. I'm hesitant to download it cuz it sounds like ya have to know what you're doing, and I don't want to do anything that messes my puter up any more than it is.

I am in the thread for first time users now, and will probably post in a few days. (I'm not on the puter every day, and then have to choose between any number of things to do in the limited time I have! accckkk!)

As to the Mozilla/FireFox, I know I'm not gonna get to that right away! I still am not sure if I will switch out of OutLook Express or not--I hate when it opens something ya click on to delete, but it sounds like the one from Mozilla's site is hard to use.

Link to comment
Share on other sites

Psalmy, Psalmy, Psalmy!!! You can continue to use outlook express. It has nothing do with Firefox the browser. Yes mozilla does have a email client but thats not what was recomended to you by the other Chatters. sigh...

Browser exploits in internet explorer allowed other people via websites you visited to execute code on your computer as if they were sitting at your keyboard. Thats why so many updates and security patches had been released to remove the vunerabilites. That is why probly why mozilla firefox (say it with me--> "Browser") was recomended to you. It doesnt have the exploits IE has/had.

Now do you know if you have a keylogger, malware, ect still on your computer? I dont, nor will anyone else unless you run some tools. I am not trying to panic you into a rash thing, I just want to help you secure your computer and to keep it from happening to you again.

oh by the way, apple a day does keeps the ah-hem Doctor away.

Link to comment
Share on other sites

***Psalmie throws chocolate pie at Apple-Dude and cringes as the sloppy mess runs into his keyboard ***

Chocolate pie!

more choc pie

THINK FAST!

Apple-a-day, siiiiigh, Ya know, if you'd have just read between the lines, you'da KNOWN I was remembering the stuff I read about in the other thread in open forums. icon_biggrin.gif:D--> icon_razz.gif:P--> NYAH! SHEEESH!

Ohhh, okay, I'll 'splain it to you. . .

Actually, when I read about Mozilla/FireFox (The BROSWER) in the other thread, I was also wondering if I should switch out of Outlook express, and get Mozilla's Email client. There is stuff I don't like about OE. (My mind was working twice as fast as my fingers!)

As to whether I still have malware, I guess I don't but I have some questions. I went to Spywareinfo, read a lot there, re-ran Adaware, Spybot and Norton AV--after updating all of em.

I also ran the scan at Trendmicro.com.

Nuttin honey. No new spyware, ads, etc since I ran Spybot and adaware last Friday.

Then I went into the MSCONFIG startup tab. I disabled a couple things that weren't needed. (I followed the links to that pacman site) And I found something that has me puzzled. I have this SysUpd.exe in startup. The Pacman site says it is "anti-spy foist ware", and that it should/could be disabled (And probably removed?). Why didn't any of those scans catch it as "bad"?

Last. I downloaded the trial version for ZoneAlarm Pro. And had all sorts of problems logging in to Greasespot. My flying piggy won't fly anymore, it's acting like everybody's icons here are threats-- so far I don't like it!!!

This firewall is saying that 107 access attempts have been made, and I've probably had it on my computer for less than an hour. And somehow, someone got ahold of my debit card # and used it to make purchases--but there are supposedly no bugs, worms, Trojans or spyware. makes me go hmmmmm.

Link to comment
Share on other sites

Ad-Aware/Spybot SD are very good "General" tools but the number and types of exploits are becoming exceedingly more difficult to detect and remove. The tools generally require to be able to "see" the files and the crapware is getter better at hidding them.

Spybot SSD is coming out with a new version in the next few days (or so promised) to better detect more of them. (version 1.3)

Yes, Pacman's portal has a presence on many security websites and is a very good database for discovering "what is this thing" But startups are not the only issue. There are BHO's

system files, and applications. (such as that Aveo that never really went away)

The Hijackthis program frequenly mentioned and used is very simple to use. You download the executable file into a permenant folder and run it.

Here is a link to a quick start on the program

Quick Start on Hijackthis

You do nothing but explain in a post at one of the security forums recomended about what happened to you and post the Log created by hijackthis if a Helper or Expert asks for it.

About the ZoneAlarm, its a good thing you are getting the alerts. It means it is catching them! But for the most part its just "noise" that has always been there and you are just seeing it for the first time. Once the novelty of having it pop up on you each time one happens you can shut off the notifications.

Zone alarm is chatty when first installed because it does have to learn from you what access is acceptable or not. ( both outgoing and incoming) If acceptable always, you check the box on the popup not to bug you about it again. If not acceptable ever you check the box saying so. Even if you make a mistake you can find that entry and remove it from being blocked or allowed. A bit of fine tuning and you probly can get Greasespot to work as you want it to. I dont use zonealarm, I use kerio personal firewall and do fine on GS.

I know this no fun, but its the exploiters which have made the internet this way. Best you can do is lock down your machine as reasonable as possible.

birdy birdy in the sky, dropped some whitewash in my eye...boy I am glad pigs cant fly..

Link to comment
Share on other sites

Gee,

you're the first user of ZoneAlarm who said they had GSC

problems that I know of. It works fine for me...

We were discussing it in the Registry Keys thread...

didn't look like ZoneAlarmPro caused problems either....

If you're getting popups about access attempts, you can switch that

off and they'll log them quietly. I got 9 drive-by scans just

sitting at the GSC in about 10 minutes.

I think downloads may or may not count as a single access attempt.

So, if you downloaded 10 programs and got 10 access attempts today

(doubt that happened), it might be all of them.

Then again, somebody else here got zero scans all day, so it's really

NOT so much where you go or problems with ZoneAlarm...

Link to comment
Share on other sites

Applesauce--er pie, I mean, um, er

Appl-aday, I did the Hijack this log, have a file for it and everything. I registerd at spyware info, and because of this durn firewall, I can't log in-- like what happened yesterday with Greasespot-- I finally was allowed in after about 8-10 log in attempts. I'm sure I could get into spyware info tonight if I had the time, but my "turn" is over, so I'm gonna have to log in and post tomorrow. I'll post here and let ya know. It looks like I am s'posed to make my post in the PC troubleshooting section.

WordWolf, I read the whole registry thread-- helpful info there, and I am sure once I get my settings figured out at Zone Alarms, I will appreciate it, right now it is horrendously frustrating! I'm gonna have to have a firewall, because we are going to get cable modem soon-- hopefully this week, since I have to cancel my dial up server.

(The idiots have no other means to accept payment, and that was the only debit/credit card we have right now. of course it is closed due to the unauthorized usage. We will be opening another, but too late for this month's payment to go through, so they will disconnect us. I'm sending them nasty letters and telling em I'm gonna tell my friends about em! LOL!)

Link to comment
Share on other sites

Balsamic,err Pslamy, no..no..wait I will get it..Ptooey, Psalty,..Psalmy!

I look forward to see you there. Just let me know who to look for.

More about the ZoneAlarm: Try putting the privacy and security settings in the internet settings control panel on medium or lower. Does that fix the access problem at GS?

Here is a tutorial on how to set access for sites you like to visit on Zone.

Privacy settings/ZoneAlarm

Link to comment
Share on other sites

Apple cart, are you upset or something? you seem to have a hard time remembering my name! SHEESH! you'd never see ME doing that!!!! Some people just never seem to be able to get over their problems with envy do they? should i say---"SACKBUTT? Hmmm? (syruppy smile here)

icon_biggrin.gif:D--> icon_razz.gif:P--> Are we having fun yet????

thanks for the link for zone alarms--I think I adjusted the settings right. My piggy is flying again. There was a disable animation choice. I unchecked that. (I mean, how would I be able to tell if I got my sackbutt moving right, ya know?)

I'm still having trouble at Spywareinfo.

I am back to trying to register there tonight. I get all the info filled in, click agree to the terms and it takes me straight to the main page of the forums--as if I didn't try to register. I have gotten no email validation.

When I try to log in, it either says my user name isn't recognized (DUH! cuz it isn't registered! LOL!)

Or it comes back with the asterisks in the password box but no user name and it tells me I have to type in a user name. (DOUBLE DUH! I DID that! several times!) I did find a link to contact the administrator, and explained the problem, telling em I just downloaded Zone Alarm and wonder if that could be blocking me.

It's giving me more time to read there, anyway!

I think I'm glad I have this firewall, although I wonder how much of this "traffic" is harmless and how much isn't. I got a notice saying something about email trying to be sent out--I had just typed an email in Outlook express and tried to send it. But this came up saying it was coming from a "Mailp.***" and what I have in my POP3 properties box has a different letter after the word mail. Is that weird or am I? (Never mind. . .)

Link to comment
Share on other sites

Apple Fritters (see I told ya I have no problem remembering YOUR screen name!) Try-- just TRY to have the same courtesy, okay???? icon_rolleyes.gif:rolleyes:--> anim-smile-blue.gifanim-smile.gif

SHHEEEEESH! The things ya have to deal with on this forum! come in here and try to make a regular post and get harrasssed! siiiiiighhhhh! snicker! (you didn't see that did you?)

Okay, now that we've got THAT settled, can you HELP ME???? LOL!!

***Psalm71one wonders if Apple is rolling his eyes yet!! icon_biggrin.gif:D--> ***

nervy, aren't I?

I got an autoreply from the administrator at Spywareinfo, telling me to click on a link, send them my email addy, the screen name I want to use, and password. Filled out that form, clicked submit and it came back blank saying I had to enter my info in the blanks! arrrrgggghhhhh! tried it several times, came back blank several times. (Counted to ten and DIDN'T do the percussive maintenance on the puter that I WANTED to do!! LOL!)

It finally went through when I shut down the firewall. So I tried to register with the firewall shut down. No go. I got that all done this morning, and while waiting typed out the post I want to place on the forums there and saved it in a Word document.

I left to run some errands, am back tonight at 6 pm, and no response from them. I typed out a new form to them again (it went through only with the firewall down), and now I'm just waiting to be registered. My post is ready, my Hijack this log ready, and did a new scan from Norton (I had gotten a netsky32 something virus in an email that Norton said they couldn't delete icon_confused.gif:confused:-->)

Now I'm drumming my fingers on the desk, staring at the screen and yelling at it every once in awhile. Will that help? icon_biggrin.gif:D-->

Link to comment
Share on other sites

Ok, Bacon girl sorry for the difficulties for getting in the forum at SWI. If you get nowhere with getting on the forums there (SWI), I have another forum you can post your log can get some attention.

Tomcoyote forums

Pretty much the same folks that post and help at SWI (including me) and is a bit easier to post to. (less traffic)

You do have to do the register thing unfortunately, most forums are having to do this now. Even here at GS you have to be a member just to read certain content. Once you register at Tomcoyote's post your log and such in the Open forum and under the topic Hijackthis logs and problems.

Yes your firewall is definetly keeping you from connecting. You might try this fix for SWI.(or any other site you might have trouble with)

In IE, do Tools->Internet Options, and delete cookies.

In IE, do Tools->Internet Options, Privacy, click Edit, add URL for SWI forums, click Allow.

Close all browser windows.

Open just one IE.

SWI like many forums want to set cookies for the browser session to remember your name and login across the sections and pages there. To keep you logged in so to speak.

Please let me know where you landed with your post.

There are these two missionaries who have been lost and wandering in a jungle for days, and they're at death's door with hunger. As they stumble on, hoping for salvation in the form of a mircle or something to eat, they suddenly spy, through the bramble, a peculiar tree off in the distance. As they get closer, they can see that the tree is draped with rasher upon rasher of bacon. There's smoked bacon, crispy bacon, life-giving juicy nearly-raw bacon, all sorts.

"My God, John" says the first man. "It's a bacon tree !!! We're saved!!!"

"You're right" says John, "Praise the Lord!" "Its a mircle!"

So John, goes on ahead and runs up to the tree salivating at the prospect of food. But as he gets to within five feet of the tree, there's the sound of a sackbutt, and he is shot down in a hail of Pigpellets. His friend quickly drops down on the ground, and calls across to the dying John.

"John, John - what happened?"....

With his dying breath John calls out ... ."Ugh, run , run ! ... it wasn't a Bacon Tree it was a........Ham Bush."

Link to comment
Share on other sites

AppleJacks, Funny joke!!! Hambush! I like it!

OOPPS! I'm NOT laughing! Really! Am NOT!!! Stop er I'll pelt ya with pig pellets! icon_biggrin.gif:D-->

Anyhoo, I am finally registered-- At TomCoyote forums. I did all the steps for trying to get into SWI, I had also added it to my ZA list(but I'm not sure if I put that in the right place--that whole firewall thing is Geek to me)

Picture Edith Bunker on a computer nowadays!! LOL!!!!! I was gonna choose something like BaconBits as my screen name, but Edith suits me too! haha!!

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...