I downloaded a zip before and it automatically ran a file. It brought up a porn site on 127.0.0.1 :eek:

Immediatly booted to safe mode and removed offending file but damage done.

Did a port scan and port 5000 is open (Back orrifice ? ) and you get [HTTP/1.1 400 Bad Request] on the scan. doing a http://127.0.0.1:500 works but get a blank screen.

What trojen is this and anyone know a remover? As for AV, i was trying out AVG with latest defs, so it should have picked it up as soon as i opened the zip file with winzip.

Symantec im coming home baby !

Sounds like it's installed some porn related pages on your PC.

127.0.0.1 is an internal "loopback" address for your own PC.

Take a look to see what your homepage is set to (Tools > Internet Options > General tab)

Look in Add/Remove programs for any "unexpected" programs

Look in Startup folder for shortcuts to "unexpected" programs

Run MSConfig, look in the startup tab for same.

The address was what shocked me. I could have coped with a "normal" site but not on my machine. I did remove the proggy. It was girlshosting ?? Never heard of it before.

Anyhow seems to have gone now.

Now this is getting on my tits. Its still there, but no dodgy services programs etc. Can still open a http on port 5000. However no av or trojan scanner picks it up

checkout...

www.safersite.com

Try running this program available here, called HiJack This http://www.tomcoyote.org/hjt/

It will find all kinds in your registry but DON'T delete everything it finds!!