Help with trojaned pc
24 July 2003, 08:56 PM
#1
Scooby Regular
Thread Starter
Join Date: May 2002
Posts: 1,893
Likes: 0
Received 0 Likes
on
0 Posts
I downloaded a zip before and it automatically ran a file. It brought up a **** site on 127.0.0.1 
Immediatly booted to safe mode and removed offending file but damage done.
Did a port scan and port 5000 is open (Back orrifice ? ) and you get [HTTP/1.1 400 Bad Request] on the scan. doing a http://127.0.0.1:500 works but get a blank screen.
What trojen is this and anyone know a remover? As for AV, i was trying out AVG with latest defs, so it should have picked it up as soon as i opened the zip file with winzip.
Symantec im coming home baby !
Immediatly booted to safe mode and removed offending file but damage done.
Did a port scan and port 5000 is open (Back orrifice ? ) and you get [HTTP/1.1 400 Bad Request] on the scan. doing a http://127.0.0.1:500 works but get a blank screen.
What trojen is this and anyone know a remover? As for AV, i was trying out AVG with latest defs, so it should have picked it up as soon as i opened the zip file with winzip.
Symantec im coming home baby !
24 July 2003, 10:09 PM
#2
Scooby Regular
Join Date: Jul 2001
Location: deep inside your imagination
Posts: 24,057
Likes: 0
Received 0 Likes
on
0 Posts
Sounds like it's installed some **** related pages on your PC.
127.0.0.1 is an internal "loopback" address for your own PC.
Take a look to see what your homepage is set to (Tools > Internet Options > General tab)
Look in Add/Remove programs for any "unexpected" programs
Look in Startup folder for shortcuts to "unexpected" programs
Run MSConfig, look in the startup tab for same.
127.0.0.1 is an internal "loopback" address for your own PC.
Take a look to see what your homepage is set to (Tools > Internet Options > General tab)
Look in Add/Remove programs for any "unexpected" programs
Look in Startup folder for shortcuts to "unexpected" programs
Run MSConfig, look in the startup tab for same.
24 July 2003, 10:29 PM
#3
Scooby Regular
Thread Starter
Join Date: May 2002
Posts: 1,893
Likes: 0
Received 0 Likes
on
0 Posts
The address was what shocked me. I could have coped with a "normal" site but not on my machine. I did remove the proggy. It was girlshosting ?? Never heard of it before.
Anyhow seems to have gone now.
Anyhow seems to have gone now.
24 July 2003, 10:40 PM
#4
Scooby Regular
Thread Starter
Join Date: May 2002
Posts: 1,893
Likes: 0
Received 0 Likes
on
0 Posts
Now this is getting on my ****. Its still there, but no dodgy services programs etc. Can still open a http on port 5000. However no av or trojan scanner picks it up
24 July 2003, 11:06 PM
#5
Scooby Regular
Join Date: Mar 2000
Posts: 2,462
Likes: 0
Received 0 Likes
on
0 Posts
Thread
Thread Starter
Forum
Replies
Last Post
Shropshire-Guy
Computer & Technology Related
16
30 December 2004 01:25 PM