The Penguin
join:2001-07-31
45 South
| Trojan detection
Acquaintance reckons he has a trojan on his pc that he cannot get rid of.
It comes up as injecterx (tri)
Avast, AVG and Trojan Hunter find it but seemingly do not get rid of it. He has also run various spyware progs to no avail. I've done a google but can find no reference to it. Anyone know what this could and how to get rid of it?
--
Dances With Marmots |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
1 edit | I am not familiar with that specific named trojan..but you might try this tool
iPMS - iSergiwa Portable Malware Scanner
»en.sergiwa.com/modules/mydownloa···hp?cid=2
and this one also
PRT Perlovga Removal Tool v1.0.2
»en.sergiwa.com/modules/mydownloa···=2&lid=4
If those AV's and Trojan Hunter finds it..can you give us the name of the files it finds that are infected..those would be in the logs of those products.
In any case you could also run those product in the safe mode and they might be able to clean it..
The tools I posted above also require cleaning in the safe mode..and of course some AV's finish that cleaning on a reboot.
--
Gladiator Security Forum »www.gladiator-antivirus.com/
Missing Kids
»www.missingkids.com/ |
|
NanDog
The Pup Was Female, I'M Not
Premium
join:2003-12-28
Tacoma, WA | reply to The Penguin
Are you perhaps referring to something like Trojan.Injecter.x? A google will give you some hits on injecter trojans.
--
See ya across the Rainbow Bridge, my good and faithful friend! |
|
The Penguin
join:2001-07-31
45 South | reply to The Penguin
Thanks Name Game and Nan Dog.
I've forwarded those links (sergiwa)to him and also another that I found with a google.
I'll post results when he gives an update.
--
Dances With Marmots |
|
NanDog
The Pup Was Female, I'M Not
Premium
join:2003-12-28
Tacoma, WA
 ·Rainier Connect fr..
2 edits | Ah, glad to see you just popped in again!
I looked through the trojan lists on my copy of TH5 and didn't see anything in that ruleset that seemed similar to injecterx (tri).
It's aggravating that all the different anti-malware companies call things by different names!
Thanks for telling us that you'll keep us posted. 
BTW, as a person who loves hiking and climbing in the PNW mountains, I love your sig line! 
--
See ya across the Rainbow Bridge, my good and faithful friend! |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs: 
| reply to The Penguin
If he did something foolish that could have resulted in a compromise then the best defense is to reinstall.
Trojan detection is a very weak thing right now. It's basically like this: if you find one using a tool, you have one. But if you don't find one it doesn't mean much of anything at all.
If in doubt, reinstall.
--
dmiessler.com -- grep understanding knowledge |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| said by Daniel  :If he did something foolish that could have resulted in a compromise then the best defense is to reinstall. Trojan detection is a very weak thing right now. It's basically like this: if you find one using a tool, you have one. But if you don't find one it doesn't mean much of anything at all. If in doubt, reinstall. what is your advice if he finds one..reinstall ? Where did you get your info that trojan detection is weak.
seems to me the op already stated a trojan was detected and three products call it out.
and this statement "But if you don't find one it doesn't mean much of anything at all."
Are you assuming that every system out there is infected ?
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
siliconman01
Premium
join:2005-05-08
Saint Albans, WV | reply to The Penguin
The Penguin,
Have him/her run the LiveUpdate on TH5 to obtain the latest rulesets. Then reboot the computer into SAFE MODE and run a full scan with TH5 and let TH5 try to remove the infection. |
|
ghost16825
Use security metrics
Premium
join:2003-08-26
| reply to Name Game
said by Name Game :said by Daniel :If he did something foolish that could have resulted in a compromise then the best defense is to reinstall. Trojan detection is a very weak thing right now. It's basically like this: if you find one using a tool, you have one. But if you don't find one it doesn't mean much of anything at all. If in doubt, reinstall. what is your advice if he finds one..reinstall ? Where did you get your info that trojan detection is weak. seems to me the op already stated a trojan was detected and three products call it out. and this statement "But if you don't find one it doesn't mean much of anything at all." Are you assuming that every system out there is infected ? In general, detection of a trojan implies a trojan is there (given 0% false positives). Non-detection of a trojan does not imply anything about the existence of a trojan. For all but the isolated case your preferred course of action should be to flatten and rebuild - that is, it should be the rule rather than the exception. By doing selective removal based on tool results you're basically saying: "I am smarter than the attacker; I know exactly how and when the attacker has changed my system and can restore the system to a known good state. (without wiping)." |
|
redwolfe_98
join:2001-06-11
 ·RoadRunner Cable
2 edits | reply to The Penguin
it might help to try running scans in "safe mode"..
another program that they could try using would be "superantispyware" which has a good reputation for removing many malware-infections..
"trojan-injector" sounds like a "storm worm"/zhelatin infection, to me..
another tool that they could try using is "GMER", which is a rootkit scanner:
»www.gmer.net/index.php |
|
Bubba1
Less is More
Premium
join:2006-09-21
| said by redwolfe_98 :another program that they could try using would be "superantispyware" which has a good reputation for removing many malware-infections.. +1
SAS does (and repairs damage from) trojans.
To try, grab the free version, here: »www.superantispyware.com/superan···pro.html
--
"Fast is fine, but accuracy is everything" --Wyatt Earp |
|
The Penguin
join:2001-07-31
45 South
| reply to The Penguin
Thanks for the replies.
Well, he ran sergiwa but that didn't pick it up.
I've now forwarded the "SAS" link to him.
Siliconman, I think he does have the latest TH that picked it up, but I've suggested that he checks that he does.
--
Dances With Marmots |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs:
| reply to Name Game
said by Name Game :said by Daniel :If he did something foolish that could have resulted in a compromise then the best defense is to reinstall. Trojan detection is a very weak thing right now. It's basically like this: if you find one using a tool, you have one. But if you don't find one it doesn't mean much of anything at all. If in doubt, reinstall. what is your advice if he finds one..reinstall ? Where did you get your info that trojan detection is weak. I spend all day, every day, doing information security at a professional level, and to do this correctly you need to be a student of the game. A popular point of discussion is the constant struggle between those who write trojans and those who try and detect them. It's widely accepted by those in the field that modern trojans are extraordinarily difficult to detect, and that if you suspect you may have one you should reinstall.
I grow tired of reminding you and others that there is a whole world of security outside the home PC environment, and that if you continue to approach things from this perspective alone you will remain ignorant. If you choose to ignore the big picture then that's fine by me, but please stop being surprised and/or defensive when I try and raise awareness.
--
dmiessler.com -- grep understanding knowledge |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs:
| reply to The Penguin
said by The Penguin :Acquaintance reckons he has a trojan on his pc that he cannot get rid of. It comes up as injecterx (tri) Avast, AVG and Trojan Hunter find it but seemingly do not get rid of it. He has also run various spyware progs to no avail. I've done a google but can find no reference to it. Anyone know what this could and how to get rid of it? Reinstall. Do not assume you can outsmart the person who got a trojan onto your system. Reinstall.
--
dmiessler.com -- grep understanding knowledge |
|
Cudni
La Merma - Vigilado
Premium,MVM
join:2003-12-20
Someshire
·BTOpenworld
| said by Daniel : Reinstall. Why? There is no suffient info to advise that action. I'm sure that there might be some malware that is not detected and that some of the malware writers are more capable than some the analysts but those are only an exception to the rule. Those in non home environment have more resources at their disposal to combat malware
Cudni
--
"Mercifully, he hit him with the soft end of the pistol."
Help yourself so God can help you.
Microsoft MVP, 2006-2007 |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
1 edit | reply to Daniel
said by Daniel :said by The Penguin :Acquaintance reckons he has a trojan on his pc that he cannot get rid of. It comes up as injecterx (tri) Avast, AVG and Trojan Hunter find it but seemingly do not get rid of it. He has also run various spyware progs to no avail. I've done a google but can find no reference to it. Anyone know what this could and how to get rid of it? Reinstall. Do not assume you can outsmart the person who got a trojan onto your system. Reinstall. Suggest you become more acquainted with the Home Security Products out there and just what they are doing most of the time
»Kaspersky warns Screenshot Captor trojan
The trend is to call everything from popups and other types of malware or possible undesireable program a TROJAN since many seem to only think there are virus and trojans out there. To even assume that course of action would be to reformat/reinstall is reckless advice without first knowing more details.
--
Gladiator Security Forum »www.gladiator-antivirus.com/
Missing Kids
»www.missingkids.com/ |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs:
| Well, yeah, I'm assuming it isn't a very simple WELL KNOWN piece of trivial adware. I'm saying if it's something invasive, and the odds are decent that a serious compromise was possible, it's best to reinstall. Seriously.
--
dmiessler.com -- grep understanding knowledge |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to The Penguin
The Penguin,
Ask your friend if possibly the trojan detected name is not really..TROJAN.INJECTOR.S.
This one seems to come up in many AV product scans and heuristics since 8 Feb..and many signaturebased AV are hitting many false positives on this..but more important..if you can get the names pf the files and loactions on the PC that are being called out this will help..All products that your friend is using have LOGS and that is where you will find the info.
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
Name Game
Premium
join:2002-07-07
North Myrtle Beach, SC
| reply to Daniel
said by Daniel :Well, yeah, I'm assuming it isn't a very simple WELL KNOWN piece of trivial adware. I'm saying if it's something invasive, and the odds are decent that a serious compromise was possible, it's best to reinstall. Seriously. I am not against that action..far from it..but know that many home users do not have the ability to reformat reinstall since they lack the CD's or the knowledge to even start the process if the had the tools.
That we can thank the manufactures out there. 
--
Gladiator Security Forum »www.gladiator-antivirus.com/ Missing Kids »www.missingkids.com/ |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs:
| Well, we don't want to avoid giving someone the advice they need because it would be inconvenient. If someone is infected with a serious trojan we need to recommend reinstallation regardless of how uncomfortable that would be.
--
dmiessler.com -- grep understanding knowledge |
|
