Trojan Spy.Goldun.ML need help

Started by DuVeL, December 06, 2006, 09:11:46 AM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

Print
Go Down Pages1
User actions

DuVeL

December 06, 2006, 09:11:46 AM
Hi guys, at 2 out of 4 computers at work we have problems with a trojan called Spy.Goldun.ML
Suggestion and tips are welcome on how to remove the bloody thing.
I've tryed AntiVir which only detects it but it keeps popping up.
 
Help!
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

suicidal_monkey

#1
December 06, 2006, 09:30:04 AM
dunno if it'll help but:
http://www.wilderssecurity.com/showthread.php?t=152238



A few general things I have done when tackling stubborn infections...

run more than one anti-spyware application to clean out infections
re-run the anti applications immediately afterwards a second time
reboot and re-run the antivir straight away
try cleaning the pc in safe mode

There's a program called hijackthis which will likely help you spot the offencing files, but it's complicated to use :)
[SIGPIC].[/SIGPIC]

DuVeL

#2
December 06, 2006, 10:11:34 AM
I've allready tryed all that stuff and NOD32 is still running but doesn't seem to find the problem.
There is a difference with the suggestion about the site you made and the virus the computers have.
On the computers here it's the: TR/Spy.Goldun.ML
 
AntiVir does recognize the virus and it's also on the list @ AntiVir but it doesn't give a proper solution.
It seems to effect my internetexplorer btw. I can't start my IE up anymore as the files seem to have been deleted from the I386 under C:\WINDOWS\I386\
With that I mean IEXPLORE.EX_
 
AntiVir gave Errors under:
C:\WINDOWS\I386\IEXPLORE.EX_ and C:\ProgramFiles\InternetExplorer\iexplore.exe
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

suicidal_monkey

#3
December 06, 2006, 11:54:20 AM
It'll be a variation of that one though so a good place to start?

perhaps try ariva? only antivir to pop up with that in google... http://www.avira.com/en/threats/section/vdfhistory/vdf_no/6.36.00.19/6.36.00.19.html
that or nod32...

other than trying to remove it in safe mode I'd suggest posting a hijackthis log somewhere like wilder
[SIGPIC].[/SIGPIC]

DuVeL

#4
December 06, 2006, 01:57:24 PM
I've got NOD running on 1 computer (30day-trialversion) and hopefully that will detect it so I can use one of the programs that was suggested in your first link.
For the rest, tomorrowmorning we're getting an ICT'er over who's going to have a look in to it.
The trojan seems to affect not only IE but also our drawingprogram...:angry:
Thanks for the replies atleast m8...
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

King

#5
December 06, 2006, 06:45:16 PM
what is an good one to remove spyware and stuff.:g:
I have  hitman pro installed now but this doesn't blog everythimg i have noticed.:ranting2: :ranting2: :ranting2: :ranting2: :ranting2:
[SIGPIC][/SIGPIC]
Look out I am coming:dmw:

suicidal_monkey

#6
December 06, 2006, 07:01:35 PM
nothing blocks everything. I use AVG and Spybot. Worked okay so far. Main thing is not to open the wrong files ;)
[SIGPIC].[/SIGPIC]

DuVeL

#7
December 13, 2006, 10:13:06 PM
I got a tip from the guys who check our network to use Windows defender (Free program if you have a legal version of windows which offcourse everyone has).
 
My computer at work still has one problem: It can't connect to the internet.
It has no problem to locate the computer which stores our files.
When I set my computer to the exact same settings as the other computers I can't locate the storagecomputer anymore (and still no internet).
 
Any suggestions oh yee of great geekness who read these forums? :flirty:
 
BTW, I've just seen this smilie: :racing:
About time it got added :D
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

DuVeL

#8
January 11, 2007, 03:52:27 PM
Okay, this problem has FINALLY been solved today!
 
It seems that the nice bugger screwed up my TCP/IP-files which had to be replaced in the old Windows98-style.
As you know in "old" Windows you could replace the files that Windows used easily but with the newer vesions of Windows like XP this couldn't be done anymore.:sideways:
Finally one guy (he was the 3rd) from the firm who checks our computers understood the problem and he tryed setting back the corrupted files oldschoolstyle and it worked!
If that hadn't worked he would have had to reinstall everything on my computer including the programs that I use for drawing (I'm the only 1 here who uses both drawingapplications, the rest only 1 program and we got them to work seperatly on 1 comp which took us alot of effort).
 
So now I can go back to work properly, offcourse I'm still testing my computer if everything is working properly again :norty:.
Oooohhh boy, look, the workday is allready over again :flirty:.
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

Anonymous

#9
January 11, 2007, 04:06:02 PM
Its easy to repair XP. Boot from the XP CD and select repair!

DuVeL

#10
January 11, 2007, 04:11:53 PM
Quote from: BlueBall;172343Its easy to repair XP. Boot from the XP CD and select repair!

Negative.
I've tryed that but it didn't work.
The file was corrupt and couldn't get repaired.
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

Anonymous

#11
January 11, 2007, 04:23:50 PM
Quote from: DuVeL;172347Negative.
I've tryed that but it didn't work.
The file was corrupt and couldn't get repaired.


But that's the whole idea of the repair, to overwrite corrupt files!

Did you try both types of repair? i.e. a repair from the first repair option or select install and then pick the other repair option that appears.

DuVeL

#12
January 11, 2007, 05:49:10 PM
Quote from: BlueBall;172350But that's the whole idea of the repair, to overwrite corrupt files!
 
Did you try both types of repair? i.e. a repair from the first repair option or select install and then pick the other repair option that appears.

Aye, both didn't work.
Somehow it got reset probably everytime again.
Must say that the previous guys from that firm who tryed it wern't the smartest guys but I couldn't do to much to the computers myself because of the waranty and such.:sideways:
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]

Anonymous

#13
January 11, 2007, 06:29:50 PM
Quote from: DuVeL;172362Aye, both didn't work.
Somehow it got reset probably everytime again.
Must say that the previous guys from that firm who tryed it wern't the smartest guys but I couldn't do to much to the computers myself because of the waranty and such.:sideways:



Sounds like there was a registry entry screwing things up for you. You can normally check in the following 3 locations to see what is being run at startup:

Code Select
1/ The Startup folder in the Programs menu.
2/ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
3/ HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\There are also "RunOnce" and "RunOnceEx" registry keys which could contain entries for startup but it is less likely to find entries there.

DuVeL

#14
January 12, 2007, 07:16:03 AM
Good info BB.
I couldn't try to much on the computers as the computers were still under warranty.
These computers at work are btw Compaqs which have a hidden partition for a reinstall.
Ahwell, I'm glad it's sorted again as now I have an Foldingcomputer back.:flirty:
Survivor of LAN V, VI, VIII, IX, X, XII, XIV, XVI, XVIII, XX, XXIV, XXX, XXXII, XXXIV and XXXVI so far...
[QUOTE]Lionheart; Grolsch to DuVeL is like spinache to Popeye [/QUOTE]
[QUOTE]Cheesepuff...A cyborg is sent from the future on a deadly mission. He has to kill Ninja_Freak, a young Man whose life will have a great significance in years to come.Ninja has only one protector - DuVeL - also sent from the future. The Terminator uses his exceptional intelligence and strength to find Ninja_Freak & attempt to terminate him.
[/QUOTE]
Print
Go Up Pages1
User actions