Ask MetaFilter questions tagged with trojan

I need to find an English translation of The Trojan Women in the public domain.

firemonkey — Sat, 22 Aug 2009 09:03:46 -0800

Does anyone know of a good English translation of The Trojan Women by Euripides in the public domain? I want to write an opera based on The Trojan Women. I'm looking for a good English translation that is in the public domain. So far, all the translations I've found are under copyright. Any good ones out there that I can use without fearing legal recourse?

stopzilla is teh devil

quseio — Mon, 18 May 2009 14:50:37 -0800

i want to remove stopzilla from my pc it just will not let its self be removed from add remove programs... i got the annoying spalsh to go away but i think its still there preety much all i had to say was said

Limewire, minus trojans please.

CwgrlUp — Thu, 14 May 2009 16:26:41 -0800

How to use Limewire more safely? My wife got a trojan virus from Limewire. (Actually TWO!) I've used Limewire for years with no issues. Now we're obviously gun-shy about that program, but is there something else we can download to supplement our antivirus programs (her - Norton, me - AVG) to check files we download? I like Limewire and would like to continue to use it but without the trojans.

Trojan Virus

roxiesmom — Thu, 14 May 2009 10:10:38 -0800

Trojan Virus Attack I have Norton Antivirus 2009, today I received a notification that I have a Trojan.Brisv.A!inf virus. After trying several different listed ways of removing it, such as downloading a removal tool (only for it to tell me that I do not have that virus on my computer). To trying to manually remove it, only to be told it cannot be removed.

I have contact Norton support and they want to charge $100 to get a specialist to fix the problem. I do not have the money to spend on that right now. My computer is important to me and I am on a network and I do not want to infect the other computers.

So I come to you to help me. Is there any other solution to this problem that would not involve me paying a lot of money.

Someone please help!!!

Virus-free or virus hiding: is my computer Conficked or just fine?

librarylis — Mon, 27 Apr 2009 11:44:38 -0800

On or around April 1, my computer caught something that caused havoc with my antivirus programs but now everything seems fine--this can't be correct? On April 1 (bad news, I know), my antivirus program (Avira) warned me that it had not been able to retrieve definition updates from the internet.

It has been a frustrating saga to figure out what might be wrong; if you're not into the saga, skip to the last paragraph for an executive summary.

I immediately had Avira run a full-system virus scan, which picked up what Avira called a Trojan (dropper?) in my Temp files that was promptly quarantined. Searching Google, the only info I found to get rid of Dropper was to install MalwareBytes and run a full scan. Well...

I checked MalwareBytes, which I already had installed eight months ago, to find that it also wasn't updating. MalwareBytes did not pick anything up in its full scan. I tried re-naming MB, but the problem was not accessing it but rather updating, and renaming did nothing.

At this point, I tried TrendMicro to see if a program that was not on my computer would pick anything up. It did not.

I then tried grabbing manual updates for Avira via a USB drive from an uninfected computer. The files fail to correctly integrate with Avira.

I also know that my Adobe, Flash, and Java programs were all nagging me to update, and I had not done so for at least five months (not my brightest move).

Several days later, I checked to see if Windows Update was working, which it wasn't. The internet, yes, Update, no.

I then downloaded Avast to see if that would pick anything up. The most up-to-date version available did not pick anything up in its full system scan. Once Avast was installed, it too was unable to update.

I deleted Avast, then restarted my computer. With restart, the desktop, start menu, and system tray failed to become visible, as did a program (Rocketdock) that I installed two years ago. Restarting again did nothing, but once I restarted in Safe Mode I was able to see the desktop, start menu, etc.

However, at that point, Firefox and IE both stopped connecting to the internet. I know it wasn't my ethernet cord, and I know it wasn't the network. The network has a kick-ass automatic quarantine that I know was functioning correctly at the time, as well as some species of firewall.

I did a system restore to a point shortly before April 1st.

At the exact same time, my power cord died. With the battery dead and no AC adapter, I unplugged the ethernet cable and let the computer sit in hibernation.

Fast forward three weeks, and I was finally able to acquire a power cord and I re-connected the ethernet cable. My computer wakes up, with Firefox open and the tabs all reloaded to current information (i.e. Slate had yesterdays's articles not those from three weeks ago). Well, great.

Avira automatically starts updating, and the update goes through. MalwareBytes updates. Windows Update updates. I immediately do a full system scan, using both MB and Avira. MB once again picks up nothing, while Avira picks up another two Trojans (different ones, this time) in my Temp files. I then deleted the named files. I updated Java, then Flash, but haven't gotten to Adobe yet.

Here is the problem: my system seems fine. Antivirus programs, Update, everything that was haywire, now seem good to go. This just doesn't seem possible when the only thing I did was disconnect the computer to the internet for three weeks, and the system restore (which didn't seem to solve the problem three weeks ago).

Executive summary: Antivirus programs, Windows Update and other critical programs failed to update around April 1, Avira antivirus sees nothing but Trojans in temp files while Malware Bytes sees nothing, power cord dies and is resurrected three weeks later at which point the computer miraculously updates all problem programs and all seems well. This surely can't be right?

Tech specs: I am running Win XP (Media) on a Dell E1405, typically using Firefox 3, with Avira Antivirus, MalwareBytes, and Spybot Search and Destroy all installed and regularly updated, Windows Firewall is on and the network also runs a firewall.

How do i get rid of this trojan?

Wolof — Mon, 06 Apr 2009 20:49:26 -0800

How do i get rid of this trojan? I appear to have become infected with the MacCinema trojan, which I installed thinking it was a legitimate Flash update. This thing redirects me every 5 mins as far as I can tell to a range of advertising sites. I've tried running sudo crontab -r, and I've looked through the library for Internet plugins (where in theory the little beastie is hiding), but can't find anything at all in that folder. Dammit!

OS X 10.4.11

Thanks!

Digital Immunodeficiency Disorder?

Rhaomi — Sun, 25 Jan 2009 17:44:21 -0800

My laptop's been infected by something that is interfering with all the usual solutions. Please help! After the recent hacking attempt that brought down Mefi, I scanned my laptop for any problems it may have picked up from it. AVG detected one threat, a trojan, which it promptly deleted. But that wasn't quick enough, apparently.

Now, my Windows XP setup is exhibiting weird behavior all around, and everything I've tried to do to fix it has been blocked. Here are all the symptoms:

Firewall - was originally turned off; I'm not sure for how long. I've since turned it back on.

Security software - AVG isn't detecting anything, but there's obviously something still wrong. Attempting to update the virus database throws an error. Most troubling, I cannot install the newest version of AVG as its website is blocked. Ditto for all the other major antivirus vendors -- trying to access their websites results in a page error.

Tech support sites - Same as above. Something is blocking all attempts to connect to the major tech help sites. I knew enough to check my hosts file, but can see no problems there. At least AskMe still works...

Google search - Searching Google for solutions leads to a standard results page. But when I click on a result, instead of going to the relevant page, it opens up a new tab and goes to a random spam site. This happens on Yahoo and other search sites as well. I can still get to the page I want by copying the URL and pasting, but it's slowing me down. And of course any link that points to a support site won't work.

Other browsers - I'd been using Firefox 3 up to this point, so I tried the other browsers on my system on the off chance they'd work better. No luck -- Google Chrome refuses to connect to *any* website, and Internet Explorer crashes immediately after launching.

System Restore - fed up with all the problems, I tried to roll back my system to a point before the infection. But to my great surprise, all the old system restore points have been deleted.

So to sum up: AV software is borked, security and support sites are blocked, searching is hampered, and I can't go back to an older system configuration. Any ideas?

PS: I know you are not my tech support, but like I said, all the more dedicated help sites I'd normally consult have been disappeared. Thanks for your time and patience!

Someone is spamming from my gmail account.

roofus — Sun, 11 Jan 2009 23:08:11 -0800

Has my gmail account really been compromised? Someone, or something seems to have spammed my entire contacts list, from within my gmail account, despite my having a strong password. (Same problem described by this german gmail user).

Has someone really stolen or guessed my password, and do I need to take anti-virus precautions beside changing my password? I am running OS X 10.4.11.

The previous activity on my gmail account suggests someone was using it elsewhere at the time the emails went out, in a GMT+8 timezone:

Browser 115.49.96.23 5:28 am (1 hour ago)

The text of the email and the header (minus 500 email addresses) are below:

---
Dear,
Good day!!!
I would like to introduce a very good company, electronic products
Wholesale dealer.
I have bought some products from company,the price was very cheap,
and the products are very good quality!
Just have a look at this web page : http://www.hpp[redacted].com/
I am sure you will could save a lot of money!
Happy new year!!!!!
Best regards!!!
introduction give you of friend!!!
---

This is the header:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=gamma;
h=domainkey-signature:received:received:message-id:date:from:to
:subject:mime-version:content-type;
bh=K6tVhE5iH9jG8/7W3sL3UlYq6awTl26w2OX6rEz6znw=;
b=aEmoNLBhwOJd78gsKoXBSfQU7ZrUJ5yW9TwQe4BS9Z95uMciQgV0xulNnSwsF78wrz
K5BSCZPAJSWwTatBtW+N3lrFHYGRYnJxBXIY2n27cuFJf+C4pZk51F7oJwQUqQDwFzHT
uZqHFcLFBsyEYbK9C3ovp4b/IPtr8ra+Qq618=
DomainKey-Signature: a=rsa-sha1; c=nofws;
d=gmail.com; s=gamma;
h=message-id:date:from:to:subject:mime-version:content-type;
b=qtqP0ZUW3LzE837BnVjmCGEIxXrpddkhrjWNDruuZm4M372ePF8bBfUUq+/qvzKgdQ
xvqRgGgOLp9VAxhgPbhVNnAAA/thhEqJtw09/A61L0gREHySwCvINze1Yfi7sY6DEZKM
ewL1U02Pwa/pHMmAUIpFgrJMxEiKi2PrjIa4o=
Received: by 10.215.100.13 with SMTP id c13mr4320711qam.377.1231738078819;
Sun, 11 Jan 2009 21:27:58 -0800 (PST)
Received: by 10.214.43.15 with HTTP; Sun, 11 Jan 2009 21:27:58 -0800 (PST)
Message-ID:
Date: Mon, 12 Jan 2009 13:27:58 +0800

Help my posessed computer!

spacefire — Sun, 14 Dec 2008 08:20:07 -0800

Firefox and sometimes IE opens random websites on its own , in new windows. I ran AVG scan and Anti Spyware as well as the Rootkit module. But even when it says my system is clean, the new windows come up in Firefox, about every two minutes. I noticed that Firefox doesn't even need to be running at first for this to occur. AVG resident shield does find sometimes a Trojan virus in some random dll (just popped up again, it's called Trojan Vundo) and I press heal or move to vault, but that didn't fix the problem. I also ran hikackthis and tried to delete whatever I deemed unnecessary or suspect from the registry, also deleting the associated files on the hard drive. But to no avail. My system is windows XP. Any other good free programs I can try to clean up my system? What about good cheap payware? AVG has been good until now but obviously it cannot cope with this new threat even in its most up-to-date form.

Damnable Trojans

Beardman — Wed, 05 Nov 2008 10:44:13 -0800

Do I have a computer virus? How can I get rid of it? I have a PC, running XP SP2 with Avast! and Windows firewall. I was downloading an album and I got a bunch of notices saying that Avast had identified a Win.32.Trojan or something to that effect, which is apparently just Avast's generic name for a virus.

When this has happened in the past, it's said, "Don't panic--just click here to delete it or move it to the safe chest." But this time, I tried to do these things, and Avast said it wasn't able to perform those actions.

I deleted the offending album right away. Then I rebooted the computer and did an Avast virus scan. It didn't up any viruses. However, a few days later, the computer is acting pretty slow.

How can I find out if there's a virus--preferably without buying any software--and how can I eliminate the little bastard?

How to get rid of the phisher?

iconomy — Fri, 17 Oct 2008 08:12:40 -0800

Someone went phishing, and hooked my daughter. What can she do now? I'm asking this for my daughter. Macbook, OSX. I know nothing about phishing so couldn't help her with this. I've been bragging about AskMe for years, so I offered to post this here. The rest of this post is from her.

- - - - - - - - - - - - - - - - - -

On 10/10 I realized that I couldn’t log onto a couple of wesbites I normally visit. Facebook wouldn’t accept my password, Hotmail
(different account than the email linked with facebook) wouldn’t accept my password and my bank’s website wouldn’t recognize my log-in name. I got confirmation from the bank that nothing was being used and I changed my Facebook password (which sends an prompt to the uncompromised email address) and was able to log on and use it until 10/15.

Last night I tried logging onto Facebook but the same problem arose where it wouldn’t recognize my password. I tried changing my password but still couldn’t log on. This morning I changed my password again and when I finally logged in I saw that there were about 15 messages sent from my name to various individuals. All of these messages looked exactly like this:

Hello Seller.

Good Day..How are you doing and hope that everything is okay...Actually i come across this your item you placed on site which i have interesting on buying it , kindly may i know present condition of this item including your latest price you are willing to sell it to me...in other for us to be able to able about this item i will be happy to read back from and you should kindly get back to me vai this email address...******@hotmail.com

Cheers

All of these messages were sent to people posting laptops for sale and the email was different than my own. I changed my bank log-on through the phone but I still cannot access my email (because I can’t remember the access question “who is your favorite teacher?” from when I started my email in middle school!). So I’d like to know if anyone has any advice or insight into my problem, or even something I could run to find/get rid of what is compromising my computer. Thanks so much for any help!

My computer might have a Trojan, now what?

matkline — Sun, 05 Oct 2008 13:30:14 -0800

It's become apparent that my computer may have a Trojan. I just received a Returned Mail notice for mail I never sent, which instead of displaying my name it displayed "jasen kimberly," and was sent to a strange russian email address: munsov@pobox.spbu.ru. I'm concerned that this may be the result of a trojan "phoning home," or using my computer to send spam.

Internet 101 for someone over the age of 8.

giraffe — Fri, 22 Aug 2008 12:52:36 -0800

Internet safety for beginners. Where do I find a simple guide to print out for my techno-phobe father? My father keeps getting Trojans on his work computer, and I can't seem to figure out what he is doing. I set him up with Firefox and Noscript. The OS and anti-virus are up to date. We use a firewall. I run Spybot whenever I can distract him for a little bit of time. I can't watch over his shoulder all day -- we're supposed to be working, after all!

So I suspect he's just doing some good old fashioned bad browsing. Unfortunately, I am a terrible teacher and I have no patience. Can you direct me to a guide to safe browsing that a 64-year-old computer-phobe would understand?

Serious bonus points if it comes in printer-friendly format. "I can't read it on the screen!" for any text longer than a paragraph is a big complaint around here.

Mr. All-knowing Super-hacker/psychologist Mefite, I need your help securing our IRC conversations...

Anonymous — Wed, 16 Jul 2008 23:47:24 -0800

Some really important info was leaked from our private IRC channel on our own server. Luckily, it was something that most people wouldn't believe without real proof, which the leaker didn't really have. So we're glad to have not been in a real shit-hit-the-fan situation yet. Can you find the weak link, or atleast offer suggestions on how to stop this from happening again? A little bit of info about our setup... We own our own dedicated server which runs a public IRCD (UnrealIRCD latest stable version if you're curious). On this network, we have our own invite-only private channel which only about 10-14 people have access to. The channel is +i and +k with a large enough key that cannot be bruteforced. On top of that, we use FiSH encryption (blowfish) inside the channel. The key for the channel is exchanged/given to others after initiating a PM session which is also blowfish encrypted after a Diffie-Hellman 1080 key-exchange. So we're pretty sure that our encryption key hasn't been sniffed at any point. Plus, even having the dedicated server rootkitted/trojanned wouldn't compromise our encrypted talk since it's only forwarding encrypted packets. All of us connect using one of the two clients - mirc and xchat.

The only way to get something from this channel that I can think of is either someone leaking the info by mistake or on purpose, or people with trojans or keyloggers. We're pretty sure none of us are infected after running multiple scans for rootkits, viruses/trojans and checking outgoing/incoming connections and processes. But it obviously cannot be ruled out since none of the tools are 100% trustworthy when it comes to detection. About someone leaking info from here, well, I'd like to think it's impossible. All of us have been a part of this channel for upwards of a year now, would trust each other, and have had access to a lot more important stuff than what was leaked. If someone wanted to make a profit off it, they could have done so quite a long time ago... Again, not ruling it out, but if there is another explanation for this leak, I'd put my faith in it being that one instead of the theory of a leaker.

The info was posted on a bunch of public forums. We're friends with the admins of all those public forums and had access to the poster's ip. Unfortunately, all of them were known TOR ips, so we cannot really find out who it was.

So, super-hacker mefites, find our weak link, and offer me suggestions on how I/we can make it even more secure. If you're a super psychologist (or is it psychiatrist?), you can even offer suggestions on how I could find the leaker by observing behavior patterns. Thanks!

anonymous throwaway mail for this question: mefitempmailacc@gmail.com

What is this mysterious process that hijacked my shortcut?

Optimus Chyme — Wed, 04 Jun 2008 10:11:20 -0800

What is this mysterious process that hijacked my shortcut? I was using Photoshop CS2 and entered the shortcut key for "Save for Web" (Alt+Shift+Ctrl+S) and instead of getting the Save for Web dialog, a very minimalist login box appeared. Intrigued, I brought up the Task manager, right-clicked on the "Login" entry in the list, and selected "Go To Process." The process turned out to be C:\WINDOWS\SYSTEM32\vidifker.exe. This is on Windows XP Pro 2002 SP2.

All web searches for vidifker turn up nothing; if this is a virus or trojan, it's probably trivial for it to generate different names for itself. But then why was it so easy to find? Is it a keylogger? Commercial monitoring software? Is anyone familiar with any of this?

Last Try Before I Shoot Old Yeller

StrikeTheViol — Tue, 27 May 2008 18:47:42 -0800

Windows XP TrojanFilter: I caught a trojan, cleaned it out, and now...100% CPU usage making my computer unusable, and I can't turn on Windows Update besides. With System Restore off, and every piece of software I've run so far telling me it's now clean, how can I fix my system without wiping my hard drive? My computer runs fine in safe mode, and I used Autoruns to delete some suspicious looking dll files. I'd use my Sony VAIO a690's restore partition, but I'm worried it won't do the trick. I don't have enough media to fully back up my computer, and I don't seem to have a Windows XP disk. With my tech wizard friends out of town, I'm stuck, and these kinds of problems aren't my forte. Any ideas before I reluctantly start from scratch?

(I've been using up to date versions of Norton Antivirus, Ad-Aware free version, Spybot S&D, and HighjackThis.)

Where are the malware scanners?

bbranden1 — Thu, 29 Nov 2007 15:34:24 -0800

Every month or two there seems to be an ominous report from a research organization about the prevalence in internet connected computers of spam bot software and trojans that (apparently) aren't picked up by pc based virus scanning programs. So how do the researchers identify them? Are there online scanners for end users that can identify spam bots, trojans, key loggers and other malware not picked up by the usual anti virus programs? Bonus: I'm running without a real time antivirus scanner, depending on regular online scanning from several sites. No problems so far. Is this an acceptible practice?

Did I Trojan Myself?

sudasana — Thu, 13 Sep 2007 18:30:53 -0800

It is possible that I programmed a virus by mistake? I'm coding a game using the Dev-Cpp IDE and the Allegro game library. Today after a compile as the IDE was linking the object files into the exe my virus scanner (Avast) pops up and says that the game exe I'm in the process of building has a trojan horse, Win32:Agent-DEF to be exact. I updated my virus scanner to the latest program and database updates, but it's still reading the exe as infected. The main exe for the Dev-Cpp IDE is not infected. Is this a real trojan horse that somehow manages to infect this exe every time I build it (deleting the infected copy and rebuilding does not help) or is Avast getting a false-positive off my game? This has never happened before and only started happening after a certain build.

CondomFilter: Leaking down at the base?

Anonymous — Thu, 05 Jul 2007 19:36:28 -0800

CondomFilter: What are the chances of a condom leaking down at the base? I recently started trying out Trojan Elexa condoms, and noticed that they are a little loose around the base. (Particularly since they have a tendency to unroll during use and leave a lot of the condom bunched up near the top [which is nice, unless it makes the condom kind of useless from a contraceptive standpoint])

Assuming I adhere to proper condom use procedure and hold the condom on as I withdraw, what are the chances of semen leaking out before that and causing a pregnancy? If basically nil, why not? Seems like it shouldn't be too hard to force liquid out of the slightly stretched latex band at the bottom, and it seems like sex is just about the right set of motions to put that to the test.

(Switching from Durex ultra sensitive, have average-sized penis, if relevant.)

Worm infestation

squidlarkin — Tue, 29 Aug 2006 20:00:14 -0800

I made a new friend! Its name is Sality. And despite all the pages I find googling it say things like "Threat Level: Low", it seems to have infected the vast majority of all the EXE files on my hard drive, including important things like Task Manager. And I've found nothing to suggest that it might be possible to disinfect the files short of just deleting them. Can I salvage my filesystem, or should I just take off and nuke the site from orbit?

Is it possible for a computer to catch spyware/malware/virus/trojan just by viewing or scrolling a compromised webpage even if no clicking no pressing yes on any popup is involved?

studentguru — Sat, 25 Feb 2006 18:20:33 -0800

I know that cookies may be automatically and surreptitiously installed on my computer when I arrive at a webpage, but what about spyware/malware/virus ? For example, after clicking and following a hyperlink in a post ( in , for example, ask.metafilter.com) , an external webpage shows up. Will my computer catch any virus/spyware/malware/trojan simply because I am staring at it, assuming the new webpage/website is already compromised?

If yes, does the fact that I have a download manager (i.e. Star Downloader) make any difference? I mean, I think a download manager will inform me when I am downloading some exe file , right?

If yes, does the choice of a web browser make any difference in preventing drive by download like this? For example, Firefox versus Internet Explorer versus Opera?

If yes, does the choice of computer platform make any difference? For example, Windows versus Apple OSX versus Linux etc?

What are the countermeasure?

Please enlighten . Thanks a million.

The best answer so far I have are the following. I think I need confirmation from elsewhere.

http://ask.metafilter.com/mefi/17185 ---- > http://isc.sans.org/presentations/dnspoisoning.php ---- not quite understand what it says. I need a dummies version.

Windows XP Annoyances for Geeks, 2nd Edition
By David A. Karp
...............................................
Publisher: O'Reilly
Pub Date: November 2004
"6.2.5.1. How malware spreads
Web sites
It may sound like the rantings of a conspiracy theorist, but even the act of visiting some web sites can infect your system with spyware and adware. Not that it can happen transparently, but many people simply don't recognize the red flags even when they're staring them in the face. Specifically, these are the "add-ins" employed by some web sites that provide custom cursors, interactive menus, and other eye candy. While loading a web page, you may see a message asking you if it's okay to install some ActiveX gadget "necessary" to view the page (e.g. Comet Cursor); here, the answer is simple: no."

run-mbi16.exe virus/worm/trojan

Kwantsar — Wed, 23 Nov 2005 09:59:21 -0800

run-mbi16.exe virus/worm/trojan I don't know what run-mbi16.exe does, and neither does the internet, as far as I can tell. AdAware tries to kill it but it reappears on reboot. I can kill the process manually every time I start my machine, but as you might imagine, that seems to be an inferior long-term solution.

Little help?

Trojan at Drudge Report?

yclipse — Wed, 06 Apr 2005 05:13:59 -0800

See http://www.professorbainbridge.com/2005/04/whats_drudge_up.html for the question. He is getting a report of a Jabber Trojan when visiting the Drudge site. Any insight here?

What are the limitations of keystroke recorders?

shoos — Fri, 04 Feb 2005 15:11:05 -0800

Keystroke recorders. What are their limitations? A Windows XP computer where I work had a trojan which was described by antivirus companies to use a keystroke recorder to steal information and send it somewhere over the net. Does the OS have built-in protection against this? Can these things record any keystroke made on a computer, or does it depend on the application?

How do I remove this computer virus?

Servo5678 — Mon, 24 Jan 2005 09:16:27 -0800

My mother's computer has picked up a persistant trojan virus. She's over 1,000 miles away so I can't work on her PC myself, so I've been talking her through things on the phone. AVG Free 7.0 detects the virus and claims to remove it, but it always comes back the next time she scans. The only thing she can tell me about the virus is that AVG removes a file with a mixture of English and Cyrillic letters in it. Any idea how I can help her slay this thing once and for all?