Ballistic

My Pc has become infected by a Trojan that repeatedly attempts to send out spam emails.
I first became aware of it when McAfee alerted me to potential worm activity.
Doing a virus scan with McAfee doesn't detect anything.
I've just done an on-line scan with Kaspersky and it detected 'Trojan-Proxy.win32.lager.ag' but isn't able to fix it. I've done a search for this trojan and drawn a blank. Does anyone here know of a fix.........please help!!

jpor

iTrader: (1)

Try here: http://www.symantec.com/avcenter/sma...ools.list.html

Ballistic

jpor

That link doesn't list the trojan I appear to have.

jpor

iTrader: (1)

This is the closest I could find for that one:

http://www.viruslist.com/en/viruses/...virusid=111699

Ballistic

Thanks jpor

andyr

Also here
http://www.pctools.com/anti-virus/en...Win32.Lager.r/
and
http://www.sophos.com/virusinfo/analyses/trojorsed.html

Info from the first that might be useful :
Once launched, the Trojan copies itself to the Windows system directory as "win32.exe "

%System%\win32.exe
It then registers this file in the system registry, ensuring that the Trojan file will be launched each time Windows is rebooted on the victim machine:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"wupd" = "%System%\win32.exe"
The Trojan also creates a file called "zlbw.dll" in the Windows system directory:

%System%\zlbw.dll
The Trojan opens a random port on the victim machine and installs itself as a proxy-server. This enables a malicious remote user to work on the network via the victim mamchine.

The Trojan also establishes a connection to 217.159.***.176 and sends the remote malicious user information about the victim machine (IP address etc.)

Ballistic

Thanks for that information andyr

Not being an expert on these matters is it suggesting I delete files win32.exe and zlbw.dll and/or block assess to certain ports/addresses.

What concerns me the most is that a malicious user may be working from and storing files on my machine.

andyr

I've reached the limit of my knowledge there !
If you've a firewall then I guess you could block outgoing access to the 217.159.***.176 IPs - can't see any probelm with that ?
Is it worth contacting McAfee directly to see if they can help you since you (hopefully) have bought and paid for anti-virus software ?
Always dangerous to delete any files if you don't know what you are doing : I had a homepage hijack problem a year or so ago and did exactly that : I ended up having to reinstall Win XP because of 1 file that I was suspicious of that I renamed out of the way !