Trojan-backdoor-coworg i need help
 

oke yeah yeah i tapped myself to soon on my back|cry| i got most trojans out of the hubbies puter, the puter shows i have internet connection, but it will show an dns error when i try to get on a webpage, it wont get emails in either, what i have noticed is that ...one way or another trojan-backdoor-coworg is getting back in the puter, now the more funnier is ( alhouth hubby doesnt find it very funny:D)...when i use run and then cmd i get the black box with the cursor leading his own life in it, it will go from the right to the left from left to the right, up and down and i cant type anything there ( looks more like a game try to grab th cursor), when i run the virus scanner it will grab the trojan, but then some minutes later its back again, any help on this one?

Easy fix 123 to never get another virus/worm/trojan

1) Throw computer in the trash can
2) Get out credit card
3) Order new one here

|couch|

Have you tried ewido?

It's one of the better general cleaners.

1) no puter in trash....the puter isnt used much its my new/old puter he use.
2) he wish he got his creditcard ....(i have that one:D)
3) no you bad woman , i am not gonna click that link, i know you are talking about a MAC:D

bill i heard of that one, where can i find a link of that? I am gonna search google for it, then i can download it on my puter, burn it on disk and put it in his puter..

google for the link. It's basiclaly free - you can buy an enhanced package but the cleaner part is free, or at least used to be free.

There's no guarantee it will work but I've seen it clean infections nothing else could.

Some infections you have to clean manually - it sounds like you have a name for the infection, if ewido won't get it then you have to google it's name for manual cleaning instructions.

Have you closed all worms doors like i told you on Adultnetsurprise ?
Cut and paste HijackThis log here.
(use bbcode "code" tag)

yep thanks for the help:)))) i know something is wrong with an dll thing and the cpu......i have to check again what the real text was because it closed very fastm, btw that was when i tried again the run...cmd. Oke me gonna download the ewoid thing

mmmmm no i didnt because i havent readed that one yet, gonna read now:)

ah i did read your post and i did the things you ask and i did download avast, now the funny thing of avast is, it didnt found anything, but misniutes later the puter strted to do strange things again, the avast i tried the first (well after my own virus scanner and spysweeper) because a other webmaster pointed me on that one before. i am gonna try the ewoid thing now first, because i saw on a google serch it is used before to remove the trojan i have:)

1 Reinstall your OS
2 Install some active antivirus (personaly I would recomend Kaspersky)

That should fix all your problems :D

Post a HijackThis log here, this way we should see what's happening with your pc.

And as a rule of thumb, anti-virus/anti-spyware scaning and cleaning works better if made in safe mode.

yep, going thru all again:D btw thanks for all the help guys and girls:))))

btw i should mention that when i leave "system restore" on that the trojan will settle itself in system restore, then shut it off, the torjan is gone and then after some minutes its back and make the cursor dance in run. lol i cant stop laughing about that one, its just looking funny, oke trying some things, i will be posting soon.

Damn Stu...your hubby sure is a trouble maker...hope he makes up for it in 'other' ways :D

Shut down system restore...the nasty fuckers will hide there and restore themsevles.

Run all scans possible in safe mode.

Personally, I like Spysweeper (just cleansed a system a few days ago with it)...sounds like you've already got that one.

The virus scanner I use (also has great heuristics for finding these fuckers)...is NOD32 from eset.com.

A cocktail of those two programs on a clean machine...should keep it clean |thumb

oh i got a other thing i need to mention! yesterday i found jushed.exe in the puter, so i checked that one in google, ofcourse first thing you find is a post "remove it imidiatly" but its just an javathing which update all the time and only use ram....well thats what you think, because a trojan can also use the name of the jaba program, oke here my thing: that javathing is in my drivers map for the dvd thing of the puter, now yesterday i burned some programs on a disk to put in my hubbies puter, it didnt work, so i whiped them out today and burned 2 new programs on it, named 25 januar, so when i putted the disk in hubbies puter guess what i got? the puter showed date 24 januar and other programs, i thought what the fuck i whiped those out and burned new ones on it, so me going downstairs checking on my puter.....it sais 25 januar 2 programs, oke me going upstairs again, and his puter said again, 24 januar 5 programs, after i putted the disk in the cd-rw it showed the right date and programs, but using the virus scan on the java nothing showed, do you think th trojan has something done with the java for my drivers?

well thats what i use on my own puter, Mr yum, i use spysweeper and quick heal virus scan and ofcourse firefox:D for 2 years i dont have any problems anymore, i did manage to put those programs in my hubbies puter before it shut down the browser and emails, i think i am getting close, i just refuse to whipe the whole puter out and reinstall all, and i dont care if it wil take me weeks to fix this, he use net for fun , he has an laptop with whireless internet for his work which he can also use at home, btw he also can use the internet connection at home on his laptop, but since my stuff is in his puter for a back up i will be carefull and try to prevent to reinstall all:D, i will win this thing, i am stu.........i can do it....yeah right:D

ahumm question..could it be that i cant get on the net with that computer because the ethernet-controle drivers are not installed?.......|couch| its a seriouse question ...but i have a feeling:D

I got my answer.....DONT SAY ANYTHING>>>>>>DONT YOU DARE!!!!!|shocking| but still i manage it |bananna| so now stu<---- gonna think what hubby ows her for getting nuts in 2 weeks:D

oke , yeah i am still doing that puter of my moron (but oh so sweet good looking hunk man of mine:D)hubby, trojans all gone, winsockfix xp done, still internet connection does show , but no access to websites and email, did a ipconfig /release, did then a ipconfig /renew there a problem, cant connect dhcp server, checked the dhcp it is running, i think i am at that point i am gonna give up (wow after 3 weeks) if no one else has an other tip for me then i think its best to reinstal the whole shit, so any tips?

i am gonna give up on this one|cry| tomorrow my day will be: burning some content on disk (i use my hubbies puter as my backup) whipe all out, reinstall all the shit and ask for divorche papers:D

i am not reinstalling, all those days, i shut off the system restore, because then the trojan was gone and i could fix alot, ques what...this eve i put the system restore on and that DAMN $#@#^%^^%$## trojan backdoor coworg show fucking up again...........and i dont have connection with the internet, fucking shit...damn arghhhhhhhhhhhh waaaahhhhhhhhhhhhhhhhhh puter.....now that helped:D

Hate to say it Stu, but at times the best solution is indeed to start over from scratch :(

i know but i was reading some stuff in google and people still had the problem after they reinstal because th fucker is still in the system, so i have 2 choises now, reinstl and deal again with the sucker...or still dealing with it without reinstalling, i dont mind to reinstal...if all will be fix, but if the system still stays infected i will have the same problem after reinstalling, and believe me, my hubby is going to pay back huge for this one...........for the rest of his life:D btw i my eyes are getting a bit dizzy because he has a flat screen and me the old fashioned screen|shocking|

did u try and delete the jpicache folder they hide all kinds of nasty stuff in there and it is not needed, you can kill it use windowasher and shred and wash with bleach :D it might help!

well i restored the bad files that way, i could check where they where, the trojan i have is removed by spysweeper but its is getting back, worse is that trojan is on the root of the puter, so i have to be carefull with what i removed, in hijjack this, it wont show, i have to look in run. cmd, regedit.....dohhhh i have to be carefull with what i remove, i did remove my viruscanner, because it looked the trojan was in there in one of the files, that could explain why my viruscanner didnt show up when i start the puter, in google i only find 5 or 7 postings abut this one, but i hav some help again from a dutch board....grin i am driving them crazy already for 3 weeks, but they still try to help me........i love those guys:)

OK this almost makes me consider letting it infect my comp to check if i can remove it in less than 2 hours. :D
My aunt calls me for help everytime her machine gets a trojan/browser hijacker and i always deal with it at a distance this way:
1. I let it infect one of my bootable hdds (i have 3 in my computer now, the other 2 disconnected physically to protect important data).
2. I make a screenshot of every step needed to cure the infection.
3. After everything is clean again my aunt gets an email with a nice illustrated step by step trojan removal procedure.

stuveltje, I still think you should post a HijackThis! log if you want help, otherwise all you will get will be "guess you should do this or that".

yes i will put a hyjack thing up, we did remove and fixed alot of things in those 3 weeks, my moron hubby had only 7 kind of trojans in his puter, only the trojan backdoor coworg is bugging the puter now, but it will only show up if i put on the system restore button, i have checked google, norton sees it and it say it removes it, but next time it will be in the puter again, i will also put up the spysweeper log, because that one sees it also and shw where it is all the time, its somewhere in the root of the puter. i will post tomorrow the hijack thing and all.

Turn off system restore for all drives.
Manually delete everything in c:\System Volume Information\ (iirc you may have to boot in safe mode to do that)
[edit]Just deleted all snapshots manually in Total Commander in protected mode without any trouble.[/edit]

and...

presto ! all your troubles are gone ! ;)

Na i did it otherwise now, what i didnt check was: if the scan system restore was clicked at spysweeper, so everytime spysweeper saw the sucker but couldnt remove it, now what i did was: go in save mode: left the system restore on, run spysweeper with ofcourse the scan system restore on. So spysweeper could remove it now, that way i could connect the net with firefox but now with ie, now i have reinstal internet explore thru the disk , restarted and all is working again, yeahhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh i mnaged after so mnay weeks, and i didnt have to whip all out and reinstal again, Stu <----shking her booty here:D

Congrats Stu |thumb

You are a tenacious one |bow|

I would have thrown in the towel and re-installed long ago.

well normal i would do the same, i would have thrown the damn thing thru the window the same day:D, but its shows when you get older you also gonna be more patience (if thats the word) and since i manage to deal with it almost 4 weeks........it means i am already very old|cry| |shocking| but i have learned alot about the programs in the puter:D