 BackDoor.Generic11.ZNE, New Trojan Horse |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
  |
 Jul 4 2009, 04:56 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 1 Joined: 4-July 09 Member No.: 348,124  |
I'm pretty sure I've got a Trojan Horse up to no good on my machine. AVG 8's ResidentShield app repeatedly picks it up - I get the standard "Threat Detected" dialog box - and calls it a BackDoor.Generic11.ZNE. It seems to be repeatedly creating a file in my Windows/System32 folder called hjgruidrtsrfiu.dll, which AVG catches and quarantines, but within seconds it's back. I think it's being created when a number of user-initiated processes begin running: the most recent examples are C:\Windows\System32\taskeng.exe, C:\Windows\System32\RacAgent.exe, and, rather ironically, C:\Program Files\AVG\AVG8\avgcsrvx.exe. But it also appears when running many other processes. In fact, I observe that opening the Control Panel is particularly good way to bring on a multiple threat detection. Telling AVG to remove the threats actually provokes a further two, always related to the processes C:\Windows\System32\SearchProtocolHost.exe and C:\Windows\System32\SearchFilterHost.exe. In each instance, the infected file is identically-named: hjgruidrtsrfiu.dll. This traps me in a repeated cycle of okaying AVG's removal of the file, though doing so doesn't seem to lead to any major system instability. Depsite repeated full system scans, AVG doesn't seem to be able to get to the root of the problem, because it keeps popping up again with depressing regularity. I haven't noticed much system performance degradation as yet, although, Windows informs me that "unauthorised changes" have been made which will prevent me from getting updates, and indeed this is now the case. Also, once I was informed Windows DNS controls are not working properly and had to be shut down. But the next time I started up the problem seemed to have gone away. I've done a couple of web searches and this particular nasty seems to be a new one on most people. There are only a few other hits that Google returns to the search string "BackDoor.Generic11.ZNE" - one of them is an unanswered post on this very forum, in fact, just yesterday. The others are all on French or German-language forums, which isn't much help to me as I'm one of those awful monoglot Anglophones, but again they're dated very recently. Any help much appreciated. Fraid I'm new to this business so I am not sure what system information you are likely to need. As a starting point, here's the basics: Windows Vista HomePremium Processor: Intel® Core™2 Quad CPU Q6600 @2.4GHz Memory(RAM): 3.00GB System Type: 32-bit Operating System Thanks in advance, |
 |
 
|
|
Jul 4 2009, 11:49 AM
Post
#2
|
|
 BC 1st Responder Group: Global Moderator Posts: 9,962 Joined: 21-October 04 From: South Carolina - USA Member No.: 3,905 |
Hi and welcome to BleepingComputer
 Let's start with Malwarebytes The process of cleaning your computer may require temporarily disabliling some security programs. If you are using SpyBot Search and Destroy, please refer to Note 2 at the bottom of this page. Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 1 alternate download link 2
-- If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. Note 2: -- MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs -------------------- "In a world where you can be anything, be yourself." ~ unknown Become a BleepingComputer fan: Facebook |
|
|
|
|
Jul 7 2009, 08:49 PM
Post
#3
|
|
|
New Member Group: Members Posts: 4 Joined: 7-July 09 Member No.: 349,554 |
I have the same exact issue on my desktop. AVG Resident Shield is detecting multiple threats...
File: System32/hjgruimempuvue.dll Infection: Trojan horse BackDoor.Generic 11.ZNE I have AVG 8.5, Malewarebytes and Spy Bot. When I first ran my scans, the system became unstable so I disconnected from my router and turned off the Resident Sheild; I ran all three scans in Normal and Safe Mode twice and everything was "clean" after the second run. I then hopefully turned back on the Resident Shield and found that the Infection was still there. I need some major help! Thanks in advance!!! |
|
|
|
|
Jul 9 2009, 10:26 PM
Post
#4
|
|
|
New Member Group: Members Posts: 5 Joined: 9-July 09 Member No.: 350,533 |
Sorry~
This post has been edited by tpr20: Jul 9 2009, 10:47 PM |
|
|
|
|
Jul 9 2009, 10:45 PM
Post
#5
|
|
|
Member Group: Members Posts: 64 Joined: 23-July 08 Member No.: 224,544 |
You must start a new topic if you are going to do this. Moderators are trying to help others. In the meantime, please be patient and they will reach you. Don't hijack other people's topics.
|
|
|
|
|
Jul 11 2009, 11:02 AM
Post
#6
|
|
|
New Member Group: Members Posts: 4 Joined: 7-July 09 Member No.: 349,554 |
my apologies! I'm new to the site and didn't realize the rules... I thought it was an open forum and in no way was trying to "hyjack" someones post. I have opened my own thread. Thanks.
|
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 20th November 2009 - 09:49 PM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.