Trojans all over the place!! HELP!

Reply #18

starchild_45 — Tue, 27 Jan 2004 07:41:40 GMT

thanks dvdiva. that dos command i forgot about. i found a site to get rid of some of thes spyware progams for free. i am going to try one or two of them. i need free software now.

Reply #17

retxx — Sat, 24 Jan 2004 00:58:06 GMT

help me please. When I went to system, settings, system performance said free resources 25%. this is bad right? How do I fix this? Thanks

Reply #16

konane — Fri, 23 Jan 2004 13:03:48 GMT

Kim Komando had this in her newsletter this morning. Lets you know who is pinging your ports and could be trying to hack in. It also has a built in look up function to identify who's doing it. There are also programs that will help you identify intruders. Oneprogram is called VisualZone and it's free. You will find it online at: color=#800080http://visualize.phenominet.com/visualzone/visualzone.htm

Reply #15

lottoshlep — Tue, 20 Jan 2004 00:16:24 GMT

When I use Kokane's link it shows IANA , Internet Assigned Numbers Authority in CA. Mailed them a querry, got an auto response with a promise of a ' prompt full investigation' and to expect a reply soon. Will see what they have to say ... but I wonder if I should try to get rid of these suckers in the mean time

Reply #14

hypersoniq — Mon, 19 Jan 2004 23:03:14 GMT

Quote: Originally posted by lottoshlep on January 19, 2004 I did the 'netstat -n' check and came up with 127.0.0.1:2327 local and 127.0.0.1:1028 foreign. When I try to locate those with my browser it comes up blank. Anyone have an idea what those could be? I do have a NIS 2003 and WinXP with all updates btw, don't have problems, just curious.TIA127.0.0.1 is your local loopback address. it's the port numbers that follow that are interestingport 2327 is xingcsm, used commonly for netscape conferen... [ More ]

Reply #13

doodoohead — Mon, 19 Jan 2004 22:50:50 GMT

Update: Both the uninstall.exe program and add/remove programs would take me to Common Names' website, and the uninstall wouldn't work. I sent a message to their help desk, and they were VERY helpful. They sent me the install .exe and in the same email sent me the uninstall .exe, and it worked!! (They first sent something that didn't work, and very promptly replied again with the above email.)I'm of the opinion that the download trojan was piggy-backing on that common names software (don't... [ More ]

Reply #12

lottoshlep — Mon, 19 Jan 2004 17:13:30 GMT

Thanks Kokane,I'm checking into it but looks like they're unfriendlies. This is a great thread with lots of good info btw,Cheers

Reply #11

konane — Mon, 19 Jan 2004 12:44:15 GMT

Quote: Originally posted by lottoshlep on January 19, 2004 I did the 'netstat -n' check and came up with 127.0.0.1:2327 local and 127.0.0.1:1028 foreign. When I try to locate those with my browser it comes up blank. Anyone have an idea what those could be? I do have a NIS 2003 and WinXP with all updates btw, don't have problems, just curious.TIAGo to http://www.arin.net/whois/ which will show their origin. Both came up when I plugged them in to their search feature.

Reply #10

lottoshlep — Mon, 19 Jan 2004 08:14:27 GMT

I did the 'netstat -n' check and came up with 127.0.0.1:2327 local and 127.0.0.1:1028 foreign. When I try to locate those with my browser it comes up blank. Anyone have an idea what those could be? I do have a NIS 2003 and WinXP with all updates btw, don't have problems, just curious.TIA

Reply #9

EXCALIBUR — Sun, 18 Jan 2004 22:27:10 GMT

If you need to stop a program or process so that you can erase or delete it use a program called ENDITALL OR END IT ALL or you can use STOPIT OR STOP IT In the future i recomend that you use these programs:ZONE ALARM very good firewall freewareADAWARE freewareSPYBOT freewareX-CLEANER like AdAware and Spybot very good freewarePEST PATROL very very good but sharewareEasy Cleaner freewareRegCleaner freewareHdValet freewareMRU Blaster or MRUBLASTERSPYWAREBLASTERSPYWAREGUARDAVG ANTI-VIRUS

Reply #8

dvdiva — Sun, 18 Jan 2004 20:06:42 GMT

if you are wondering what something is after you hit ctrl-alt-del then check out this site: http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Reply #7

konane — Sun, 18 Jan 2004 19:10:10 GMT

Go to Trend Micro House Call for a free scan and select Auto Clean. They will download an applet and scan the drives you select. They find stuff others can not and either remove it during the scan or give you a program which is specific to the virus. Have used them for years with only good things to say. http://housecall.trendmicro.com/housecall/start_corp.asp

Reply #6

doodoohead — Sun, 18 Jan 2004 18:54:50 GMT

Thanks to everyone for your help. I haven't tried the f8 move yet* but I did get rid of comwiz.exe, and favorites.exe is nowhere to be found now. Still have winnet.exe...what the heck is it anyway? A search for winnet says it's in the Address Bar folder, but the only folders with that name are the files quarantined by Spybot. Also thank for the tips...I've got Norton 2003 (with the latest downloads**), Ad-aware, and Spybot. I understand Microsoft used to have a free reg clean but it's not... [ More ]

Reply #5

Bryan — Sun, 18 Jan 2004 18:23:54 GMT

You may want to boot up in safe mode and run your Norton's. That will prdvent some, if not all of the file from running, so it may be able to get them out. Also, there is a runonce section the registry that hides the little critters. I will see if I can find the instructions on removal in this area. It's been a while since I have to go that deep for them. I've had to remove some of them in this area before because some rename themselves every time the computer is rebooted.But try the safe mode... [ More ]

Reply #4

dvdiva — Sun, 18 Jan 2004 18:16:31 GMT

if you are worried that they are trojans click on start -> run -> cmd then at the dos prompt type netstat -n this will list any connections your computer has. for the most part you can ignore port 80 connections or you can just type the number in your browser like this 216.119.124.159 (that will bring up lotterypost) if you wonder if its a legitimate web page or not.also here is a nice free antivirus program: http://www.avast.com/i_idt_1016.html you have to register it with them but its free.... [ More ]

Reply #3

golotto — Sun, 18 Jan 2004 18:05:44 GMT

good riddance to the trojans...i run full time antivirus AND firewall protection and i still had a trojan enter my system last week! The protection programs alerted me of a trojan but somehow it still came through. It supposedly was quarantined and i deleted it from quarantine...but it still kept changing my homepage even after deletion. it wasn't gone.i remedied the situation and am now completely clean. first, i saved* all essential info from my documents and my pictures and favorites onto a d... [ More ]

Reply #2

hypersoniq — Sun, 18 Jan 2004 17:49:27 GMT

look in your favorites folder in IE to see if anything there diesn't belong, that's where favorites.exe usually comes into play, copying entire websites for your offline browsing.

Reply #1

Todd — Sun, 18 Jan 2004 17:20:52 GMT

For winnet.exe and comwinz.exe, try this:Go to ADD/REMOVE software in configuration. Remove commonname . You have to be online. You'll be connected to commonname. There you''ll be asked if you're sure.....If yes then you can download an uninstall-tool.If that doesn't work, try this:Open 'Program Files' and then locate a folder called 'CommonName'. Inside this folder there should be two more folders, 'Address Bar' and 'Tool Bar'. You will see the exe programs there but you should also see... [ More ]

Trojans all over the place!! HELP!

doodoohead — Sun, 18 Jan 2004 16:53:48 GMT

I've got programs running on my PC that I can't kill! winnet.exe, comwiz.exe, and favorites.exe. I've gone to msconfig to say, Don't run these, but they keep coming back. Task manager can't end process , and even when I try to delete them, I can't (file in use). I can move them and rename them but I can't stop them from coming back. Norton keeps killing download trojan , and Ad-aware and Spybot find them but can't kill them.HHHEEEEEELLLLLLLLLLLLLPPPPPPPPPPPPPPPPPPPPP... [ More ]