Jeff Wiltshire

You've got a Trojan

Have a look here

http://securityresponse.symantec.com...nettrojan.html

jameswrx

iTrader: (4)

Thanks for that.

Just downloaded a virus checker, found BugBear.A on my computer, done a search for it, something to do with emails and controlling my printer. Also downloaded a special BugBear remover and all seems to be successful.

But I still have Unwise problem that only allows me to fully start windows xp only when I have moved 3 processes for Unwise.exe from the task manager.

Any ideas?

Jeff Wiltshire

You still have the Trojan......You need to follow the removal process on that link. Bugbear will not do what your experiencing.

jameswrx

iTrader: (4)

I done a full system scan (all files) but nothing was discovered about the trojan files

Jeff Wiltshire

Look at the removal procedure regarding the registry settings (ie all the info about RunOnce & Unwise.exe).

Check that your machine does not have these settings.

and so on.

Which Virus checker to you get ??? Has it got the latest definition file ???


3. Deleting the value from the registry

CAUTION: Symantec strongly recommends that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

a. Click Start, and then click Run. (The Run dialog box appears.)
b. Type regedit, and then click OK. (The Registry Editor opens.)
c. Navigate to each of these keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServicesOnce

NOTE: All the keys do not exist on all the systems.

d. In the right pane, delete the value:

WinLoader %windir%\UNWISE.EXE

NOTE: This value may vary. Look for any value that refers to the files detected as Backdoor.NetTrojan.

e. Exit the Registry Editor.

jameswrx

iTrader: (4)

I tried deleting the winloader/unwise from the registry but I delete them in the order below

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\RunServicesOnce


and when I click back on the first one the winloader/unwise.exe is back as it is on all of them, I delete them and they come back.

I got something called Gladiator antivirus

Jeff Wiltshire

One or more of your files is infected ....

Try and get a version of Norton AV or Symantec which should find the relevant files. I've never heard of Gladiator

jameswrx

iTrader: (4)

just got norton and it said like you did that a backdoor trojan was detected, said it can't repair and gave me a link to the page you did.

Trouble is norton didn't finish installing properly and something happened and every time I click on norton or my gladiator virus checkers i get an error pop up saying;

windows cannot access the specified device, path or file. You may not have the appropriate permission to access the item.

Jeff Wiltshire

Which files did it say where infected ? You need to delete the ones that are infected.

I suggest that you uninstall both your AV products and then try and install Norton again.

mega_stream

My bruv asked me to check out his pc last week, he'd been on ADSL for a week without a firewall
I think the ISP's should provide some basic firewall software as the majority of people don't have a clue what's going on with their PC's.

You should have seen the amount of connections established on his PC
It's tighter than a ducks ar5se now though

Jeff Wiltshire

People still think that Hackers/Script Kiddies etc will only go after large corporates....the reverse is true....I see upwards of 20 scans of my broadband connection per day.

If you have an always on connection get a firewall & Anti Virus software!

Simply really.

James

How far have you got with your machine ?

jameswrx

iTrader: (4)

I wish I could uninstall both my av programs but when I click on control panel for example, a box with a red cross pops up saying 'cannot find C:\windows\etc\etc...' for whatever I click on, Norton, etc, can't even use the 'Run, regedit function.

Only the internet works!

Jeff Wiltshire

Looks like the Trojan has completely trashed your PC......time for a re-install I'm afraid.

jameswrx

iTrader: (4)

Yeah I think so!

Thanks for the help anyway

jameswrx

iTrader: (4)

Someone from 218.74.45.187, port 1653 wants to send UDP datagram to port 1434 owned by 'UNWISE.EXE' on your computer

This is what keeps happening (shown up by my firewall.

I have real problems with Unwise??, every time I turn the computer on it wont load until you remove Unwise from the proccesses in the task manager 3 times!

What is it?, and as I say I get lots of requests from IP addresses either trying to get to Unwise or Unwise trying to send stuff out?

I put a new firewall on yesterday and it actually said that an IP wanted to contact Unwise as soon as Windows XP started loading.

Any ideas?



[Edited by jameswrx - 3/8/2003 10:52:05 AM]