corsasport.co.uk
 

Corsa Sport » Message Board » Off Day » Geek Day » Help re Trojan Downloader Win32.Small » Post Reply

Post Reply
Who Can Post? All users can post new topics and all users can reply.
Icon:
Formatting Mode:
Normal
Advanced
Help

Insert Bold text Insert Italicized text Insert Underlined text Insert Centered text Insert a Hyperlink Insert Email Hyperlink Insert an Image Insert Code Formatted text Insert Quoted text
Message:
HTML is Off
Smilies are On
BB Code is On
[img] Code is On
Post Options: Disable smileys?
Turn BBCode off?
Receive email notification of new replies?

Robbo

posted on 29th Dec 07 at 14:08

Try Spybot Natalie, Im sure I downloaded that on the computer once so u shud still have it


Andrew

posted on 28th Dec 07 at 20:07

Bank details will be encrypted.

You probably just need to format.


Robbo

posted on 28th Dec 07 at 20:04

quote:
Originally posted by Dom
download spybot - search & destroy, make sure you update it then go into safe mode and do a check - that might sort it :)
Think she tried that


Steve

posted on 28th Dec 07 at 19:58

quote:
Originally posted by Natalie
:lol: Its not porn :P
you mainly get this stuff from visiting dodgy sites like porn though


Dom

posted on 28th Dec 07 at 19:54

download spybot - search & destroy, make sure you update it then go into safe mode and do a check - that might sort it :)


Robbo

posted on 28th Dec 07 at 19:49

D'oh


Tiger

posted on 28th Dec 07 at 18:12

quote:
Originally posted by Natalie
quote:
Originally posted by Dom
you could try downloading Unlocker (google it), then right clicking the .dll file, unlock it (right mouse click the file, select unlocker) and then deleting it.

Tried doing that and it kept creating a fatal error :(

Cant run an F-Secure scan in safe mode as it wont open F-secure in safe mode :S

Andrew - so are you saying that im a bit fucked?

I can live with the popups etc but I just want to make sure that it cant spy my account numbers etc and that I will be safe to make payments etc

:)


As far as i'm aware, unless its a keylogger your computer doesnt store any bank numbers on it anyway for security reasons?


Natalie

posted on 28th Dec 07 at 18:09

quote:
Originally posted by Dom
you could try downloading Unlocker (google it), then right clicking the .dll file, unlock it (right mouse click the file, select unlocker) and then deleting it.

Tried doing that and it kept creating a fatal error :(

Cant run an F-Secure scan in safe mode as it wont open F-secure in safe mode :S

Andrew - so are you saying that im a bit fucked?

I can live with the popups etc but I just want to make sure that it cant spy my account numbers etc and that I will be safe to make payments etc

:)


Andrew

posted on 28th Dec 07 at 17:46

I have a system at work with this same virus.

Tried Norton and AVG to shift it but will not remove. Also tried Safe Mode.

Needs flatening and rebuilding but for the cost of doing that they may as well as buy a new PC.

It's a new company we are supporting. I personally think we should charge them half the price to get into there good books. Not down to me though, it's the managers decision.


Natalie

posted on 28th Dec 07 at 16:16

OK cheers lads, ill try those


Aaron

posted on 28th Dec 07 at 16:08

Run, your computer is about to explode!


Dom

posted on 28th Dec 07 at 16:05

you could try downloading Unlocker (google it), then right clicking the .dll file, unlock it (right mouse click the file, select unlocker) and then deleting it.

Personally i would download AVG (another anti-virus) and see if you can get rid of it using that or atleast get the name of the trojan - as Win32.TrojanDownloader.Small is just the type. Tthen google for a program to get rid of that virus - usually symantec (on their website) usually do programs to get rid of specific virus' :thumbs:


Liam

posted on 28th Dec 07 at 16:04

Boot up in safe mode, then scan your pc and it should be able to delete it. I think.


Natalie

posted on 28th Dec 07 at 16:02

It doesnt show up in there


Marc

posted on 28th Dec 07 at 15:57

You could try deleting in Add Remove Programs but chances are it will keep coming back.


Natalie

posted on 28th Dec 07 at 15:53

Scanning Report
28 December 2007 15:19:22 - 15:25:38
Computer name: HOME
Scanning type: Scan system for spyware
Target: System


--------------------------------------------------------------------------------

Result: 2 malware found
ClickSpring (Malware)
REGKEY:HKLM\software\clickspring
Action: deleted
Win32.TrojanDownloader.Small (Malware)
FILE:C:\WINDOWS\system32\opnmjih.dll
Action: deleted FAILED


--------------------------------------------------------------------------------

Statistics
Files:
Scanned: 0
System: 12308
Not scanned: 1
Result:
Viruses: 0
Spyware: 2
Suspected: 0
Actions:
Disinfected: 0
Renamed: 0
Deleted: 2
Quarantined: 0
Failed: 1
Boot Sectors:
Scanned: 0
Infected: 0
Suspected: 0
Disinfected: 0
Files not scanned:
An error occurred while scanning (error code 60002)


--------------------------------------------------------------------------------

Options
Definitions version:
Viruses: 2007-12-28_03
Spyware: 2007-12-03_05
Scanning Engines:
F-Secure AVP: 6.00.169, 2007-12-28
F-Secure Libra: 2.03.06, 2007-12-26
F-Secure Orion: 1.02.37, 2007-12-28
F-Secure Draco: 1.00.35, 2007-11-28
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD LSP MAP MHT MIF PHP POT SWF WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
Scan inside archives
Actions:
Viruses: Ask after scan
Spyware: Ask after scan


Natalie

posted on 28th Dec 07 at 15:51

:lol: Its not porn :P



F-Secure can't delete the file either :(

[Edited on 28-12-2007 by Natalie]


Marc

posted on 28th Dec 07 at 15:50

Format c :look:

and stop viewing porn :|


Natalie

posted on 28th Dec 07 at 15:35

Ive got Malware on my C drive, it makes my computer go slow & keeps bringing up popups of gambling/poker adverts etc.... I dont know whether or not to go into my bank website/buy things as I'm scared it will get my card details :|

My anti-virus software cant delete it, and it says I dont have permission to delete it myself :|

F-Secure (my AVS) spyware search keeps bringing up one file, opmijh.dll which is in the System32 file, but when I go to delete it it says I cant rename/delete etc as the program is in use.

Help me pls :(