Giveaway of the Day Forums

1. 

   LeKanaw
   Member

   Bonjour Everybody :*)
   I think I need some Help & Advice ...

   I have a *screaming* Kaspersky on my husband's Acer Laptop.
   Kas says: dropper.win32.agent.vhe
   A² scan says: dropper.win32.agent.ucd

   Are these two the same critter?

   Have NOT dwlded anything lately!
   Last soft dwlded from GOTD was A²
   In fact this machine has not been used much at all ...
   The PC is On/Connected, but haven't even touched it in the past 48hrs !!!!
   How does this happened??!!

   The alert from Kas says this critter is in the zip of a program (Floola) we dwlded 5.5.08 - This soft was installed & uninstalled soon after!! Don't know why we kept the zip :(
   But now in the zip Properties I get: "Modified 16.8.08 at 14h10"

   Kas says: Can not be disinfected.
   So, do I just click the "Delete" button & that's it?
   Is this sufficient? What else do I need to do?

   Boy, I'm all stressed out. Plus w the other one screaming like mad ...
   Confused Mangoette
   Thank you very much!

   *************************
   Specs:
   XP SP2, FF - And I think everything is updated.
   IE.6 (Yes, yes I know!! Should update the damn thing, but we never use it! Keep putting it off to later ...)

   Posted 16 years ago #
2. 

   jlouis7518
   Member

   slt
   excuse moi je te répond en français, mon anglais est vraiment trop scolaire
   j'ai vu sur le site de f-sécure que au moins un des deux fichiers est un trojan,
   Added: Trojan-Dropper.Win32.Agent.ucd [1]
   l'autre est retrouvé sur le site de kasperpay en russe et detecté le 8 aout 2008
   8 августа ( août ) 2008
   Trojan-Dropper.Win32.Agent.vhe 16:17
   sur un forum il mentionnent je cite :
   'un logiciel facile, gratos et efficace pour en virer certains (mais pas tous) est SpybotS&d, avec notamment une version française, disponible ici http://sebsauvage.net/logiciels/spybotsd.html ou bien aussi TheCleaner http://www.moosoft.com/thecleaner/download.php ; et puis il existe des scans anti-troyens en ligne ici http://assiste.free.fr/p/frameset/03_06.php'

   je connais au moins le premier qui fonctionne bien pour pa mart quand j'ai un problème de ce genre je prends avg anti spyware qui est très éfficace gratuit en version complète pour 15 jours je crois après il faut le lancer manuellement
   sinon tu as spyware terminator gratuit ou t'éssaiye les anti 'tout ce qu'on veux' en ligne ici par exemple http://www.zabra.org/antisvirus_outlis_en_ligne.htm

   en espèrant que ça t'aide
   bonne fin de soirée

   JL

   Posted 16 years ago #
3. 

   LeKanaw
   Member

   Gros Merci JLouis
   Super gentil de ta part!!

   Oui, j'avais déjà demandé à Google, qui m'a donné les mm sites q toi!
   I translated the Russian site, but that didn't give me much help :-(

   •• I already have SpyBot installed, and cCleaner, and others ...
   •• But I don't know "TheCleaner"
   •• I also have Spyware Terminator & SpySweeper installed & running. Since my problem is a Trojan, they didn't detected anything. I don't think anti-spyware programs can help in this case.

   So, I'll go now read about all the info you gave me!

   Once again, Thank You very much!! :*)
   Mangoette!

   Posted 16 years ago #
4. 

   jlouis7518
   Member

   j'espère que ça t'auras aidé moi je me mefie de A² j'avais la version gratuite et ça m'a planté mon pc pendant 1 journée le temps que je répare les dégats de ce fait j'utilise uniquement ccleaner, spyboot de temps en temps et tune up c'est ceux que je maitrise le mieux.
   sinon là j'essaie "thecleaner" qui est gratuit il a l'air pas trop mal à priori
   tient-moi au courant de ta désinfection.
   et au fait une restauration antérieure à la date du problème ça le ferait ?

   JL

   Posted 16 years ago #
5. 

   LeKanaw
   Member

   Hi JLouis

   Well, that's strange ...
   I have A² installed on 4 PCs, they haven't given me any problems.
   It slows down the machines a bit, but overall I like it!
   The ones we have are the "Pro" though - GOTD from 3.8.08 - don't know if different from yours?

   Regarde, le site q tu m'as donné a changé de place:
   http://assiste.com.free.fr/

   Gros Merci encore
   Mangoette

   Posted 16 years ago #
6. 

   Robert
   StrayCat

   Hi LeKanaw,

   Could you tell the name of file that was (is) supposed to be a troyan?
   I had a similar problem when my AV thought an uninstaller of a certain program was troyan.LOL.
   Please update your AV definitions files and run a full scan again.

   Posted 16 years ago #
7. 

   LeKanaw
   Member

   Salut ~Robert~

   Merci d'être venu :*)

   As I said in the first post:
   Kas says: dropper.win32.agent.vhe
   A² scan says: dropper.win32.agent.ucd

   Hummm, maybe this is not what u'r asking, is it?
   Tu veux savoir le nom du programme infecté? Ou ce q me dit Kaspersky?

   Posted 16 years ago #
8. 

   Robert
   StrayCat

   Manu,

   Bonsoir.

   Yes ,please tell me the name of the file that is (supposed to be) infected.
   Oui, donnez moi le nom du fichier qui semble être infecté.
   And it's location...
   Et ou il se trouve..

   Posted 16 years ago #
9. 

   Anonymous
   Unregistered

   I always follow this guide, and its worked for me everytime.....
   http://www.computerhope.com/forum/index.php/topic,46313.0.html

   Posted 16 years ago #
10. 

    Robert
    StrayCat

    Manu,

    I have reread this thread.I suggest deleting the zip file (use shift-delete buttons).
    This probably will solve your problem.
    :)
    (no use keeping a zip file of a program you don't use anyway,is there..)

    Posted 16 years ago #
11. 

    LeKanaw
    Member

    Hi ~Robert~

    •• The file that's infected is in the dwld Basket on D:\\
    •• The infected program is Floola-win.zip/floola.exe

    The program itself was uninstalled in May.
    Only the zip remains.

    Thanks

    Posted 16 years ago #
12. 

    delenn13
    Minbari Ambassador

    Thank you, Robert.

    That is exactly what I would have said; but GAOTD wouldn't let me sign in.

    Mango Princess, delete the zip and rerun your scan. It was more than likely a FP since you had the file on your PC since May.

    Posted 16 years ago #
13. 

    LeKanaw
    Member

    Hi ~Robert~

    As u say, no need to keep the file - Indeed I intend to delete it ASAP!!!!!!!!!
    I just didn't want to do *anything* b4 knowing the whole procedure.

    For now, Kas *and* A² are waiting for instructions:
    • Kas: Delete
    • A²: Quarantine or Delete

    Just wondering in what order I do it, what precautions to take, etc, etc, ...
    Do I delete the zip now or *after* A² and/or Kas have done their thing?

    Plus do I cross my fingers behind my back or in front??
    You know ... just in case ...

    Also, what do u mean by "Shift Delete"
    Never did that ... How is this different from "Delete"??

    Mangoette :*)

    Posted 16 years ago #
14. 

    Robert
    StrayCat

    Princesse,

    Any way that you want will do.

    You can use the delete option of Kas too.Disregard A2.
    I suggest crossing your fingers behind your back.LOL.
    :) :*

    Or disregard Kas and A2 and simply use 'delete' button, but in this case you will have to remove the file from your recycle bin too (la poubelle)

    PS Using shift+delete buttons bypasses the recycle bin

    Posted 16 years ago #
15. 

    delenn13
    Minbari Ambassador

    I would suggest doing the "Hokey-Pokey" then ...... crossing your fingers behind your back.

    Then delete. :)

    Posted 16 years ago #
16. 

    LeKanaw
    Member

    Bonjour Ambassador :*)

    Gee, so stress out, only now saw your post!! Sorry

    Yes, I suppose it could be a FP.
    I'm still wondering, it's possible this critter latched itself on to that zip, right?
    Could have been another zip or another file, it was that one by chance, oui?

    ~Robert~
    Ahhh, did not know about the Shit/Delete trick
    Thank you!!

    So I'm going to go click "Delete" on Kas now.
    Then will delete the zip.
    I'll be back right after

    Just so great you all came to the rescue!!!

    Posted 16 years ago #
17. 

    Robert
    StrayCat

    Hi Delenn,nice of you to join us.I should hit that F5 more often.
    Will mambo no 5 do..?
    ;)

    Posted 16 years ago #
18. 

    LeKanaw
    Member

    Thank You Ambassador :*)

    You silly, you are making me laugh!!
    Can always count on you to calm me down!
    Luv u

    Princess of the Mango Order

    Posted 16 years ago #
19. 

    delenn13
    Minbari Ambassador

    Well, someone has to keep you calm, Little Princess. :)

    As Ambassador Londo said....

    "Londo: These Earthers! I try to find out as much as I can about them to try to make some sense of them, but it never seems to come together.
    Delenn: They do seem to be a mass of contradictions.
    Londo: Exactly my point! Here–six thousand years of recorded history, a history that includes remarkable composers, astonishing symphonies! But what is the one song that half of them sing to their children generation after generation?
    You put your right hand in,
    You put your right hand out.
    You put your whole self in,
    And you turn yourself about.
    You do the hokey-pokey,
    You give a little shout.
    That's what it's all about!
    It doesn't mean anything! I have been studying it for seven days! I had the computer analyze it! I swear to you, it does not mean a thing!
    Delenn: We've come at a bad time, haven't we?"

    Hi Robert! Just wait until Londo finds about Mambo No 5. His hair will even curl more.

    Posted 16 years ago #
20. 

    LeKanaw
    Member

    Ok Then ...

    • Clicked Delete button on Kas
    • Used my new trick Shift/Delete on the zip
    • Started a scan w A² - It hasn't started on D:\\ yet, it's still scanning C:\\
    • Took out my Special Sword & been doing the Hokey-Pokey, as per Ambassador's instructions ;-)

    Waiting for results ... from A² ... *not* the Hokey-Pokey!!
    Should I do a scan w Kaspersky afterwards?
    If so, it'll probably take a couple of hours at least, wont know the results right away.

    =*=*=*=*=*=*=*=*=*=*=*=*=*=
    ~Robert~

    What is this "F5" thing you speak of? Is this a another trick??
    Maybe trying to confuse me, are you??
    I tried it see, but there wasn't any song hiding in there ;-) Haaa AhAhAhhhh

    Because you know, the Swords are out now! I'll chase you down ...
    As you know I run fast and I always catch you!!! :*) Muhahaaahwaaa

    Princess of Clowness

    Posted 16 years ago #
21. 

    LeKanaw
    Member

    Bonjour FullBug!!

    With all the confusion I didn't see you there!! Sorry!!!
    Yap, seems I'm blind too now ... *sigh*

    Thank You very much for the link!! Just peeked briefly, it does look very useful.
    They seem to have a few tutorials too :D
    I'm going to BM it right away. Will explore it more for sure.

    Thanks again
    Princess of Mango

    Posted 16 years ago #
22. 

    Anonymous
    Unregistered

    No problem LeKanaw, if you follow the main steps, like using the SAS and Anti-malware bytes, you should be better of if you have any trojan problems again....

    Posted 16 years ago #
23. 

    LeKanaw
    Member

    Hi Ambassador

    Ahhh HaHa
    Indeed, typical Londo.
    And typical Earthers

    As usual, can't figure out how in the hell u can come up w this stuff always so à propos - always so quickly ...
    Hummm, magic me thinks !!! ;-)

    Princess of Clowness

    Posted 16 years ago #
24. 

    LeKanaw
    Member

    Well, one shouldn't cry victory too soon!!!

    Kaspersky started screaming again :-(

    Now it says the Trojan is in the Temp files ...
    Button Delete & Desinfect are both greyed out ...
    Gonna do a pass w cCleaner, that should help I think!

    Will do a deep scan afterwards.
    Probably will take all night

    Will post the results tomorrow morning I guess!
    Princess of the Mango Order

    Posted 16 years ago #
25. 

    AxCut
    Member

    Bonsoir La Princesse,

    I´m sorry that the bug is still bothering you. I´m sure it´ll get fixed with all the help you got here. Unfortunately I can´t help with the bug, but if the trick Robert is using to confuse you is still bothering you, I´ll have you know that it is just a shortcut for renewing the browser´s page to see if there are new posts. I don´t know if other browsers use the same key, but IE does, so it is pretty harmless.

    Prochaine,

    AxCut

    Posted 16 years ago #
26. 

    my_name_is_brad
    Member

    you can pretty safely delete everything in your temp folder. The worst that may happen is you lose a few preloaded preferences from web pages and the like. Nothing functionally important is stored there.

    it's strange that anti virus/malware software would move a file to there. I would clear the temp folders and run the scan again. Trojans need to be activated (whether by an application or direct clicking) to become functional, so deleting/moving/copying will not activate the actual code within.

    Posted 16 years ago #
27. 

    Violet4714
    Member

    yes, the temp thing seemed very strange...even to me, the non-expert...

    then i searched...and found this surprise:

    http://www.prevx.com/filenames/X1622114754927674195-0/FLOOLA.EXE.html

    partial: FLOOLA.EXE has been the subject of the following behavior(s):
    Executed from Temporary Folders

    odd...

    Posted 16 years ago #
28. 

    Robert
    StrayCat

    Good morning Princess,
    :)

    You've probably solved the problem by now by deleting those files in your Temp folder
    manually or with CCleaner.
    I should have told you ,that whenever you open a zip file it extracts itself to the Temp folder.

    Amicalement,

    ~Robert~

    Posted 16 years ago #
29. 

    LeKanaw
    Member

    Bonjour everybody!!!

    Phewwww, finished battling the Dragon ...

    The sick machine (Acer Laptop) also has a hardware problem, ie the "On" button has a mind of it's own and functions only when it feels like it!!!
    It's a major problem, cause it's connected w the Motherboard. Trying to manage it so it last for a while longer.
    So we seldom close it down, which we had to do several times during the cleaning process of that critter.

    Couldn't put it "On" again for the longest time in between each closing...
    We are using it as is, a first evaluation was rather dim - everything is connected on laptops so it would be *very* expensive to repair :-(

    Anyway, apparently all is back to normal now!!! :D ... As long as I don't shut it down ...

    Really want to THANK EVERYBODY that came to the rescue!!

    Geeks Unite!!! Yeahhhh ...
    A very relieved Princess,
    Manu

    Posted 16 years ago #
30. 

    LeKanaw
    Member

    Buenos Dias Ax

    ¿Cómo está Usted?!! Hace mucho q no hablamos!! ...

    Yes, I know about the F5 function :D
    Was just trying to be funny, looking for Robert's song in there ... :*)
    I use FF but yes, it works on all browsers.

    Muchas Gracias,
    Manu

    Posted 16 years ago #

RSS feed for this topic

Reply »

You must log in to post.