 BackDoor.Generic11.ZNE, New Trojan Horse |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
 Jul 4 2009, 04:56 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 1 Joined: 4-July 09 Member No.: 348,124  |
Hey,
I'm pretty sure I've got a Trojan Horse up to no good on my machine. AVG 8's ResidentShield app repeatedly picks it up - I get the standard "Threat Detected" dialog box - and calls it a BackDoor.Generic11.ZNE. It seems to be repeatedly creating a file in my Windows/System32 folder called hjgruidrtsrfiu.dll, which AVG catches and quarantines, but within seconds it's back. I think it's being created when a number of user-initiated processes begin running: the most recent examples are C:\Windows\System32\taskeng.exe, C:\Windows\System32\RacAgent.exe, and, rather ironically, C:\Program Files\AVG\AVG8\avgcsrvx.exe. But it also appears when running many other processes. In fact, I observe that opening the Control Panel is particularly good way to bring on a multiple threat detection. Telling AVG to remove the threats actually provokes a further two, always related to the processes C:\Windows\System32\SearchProtocolHost.exe and C:\Windows\System32\SearchFilterHost.exe. In each instance, the infected file is identically-named: hjgruidrtsrfiu.dll. This traps me in a repeated cycle of okaying AVG's removal of the file, though doing so doesn't seem to lead to any major system instability. Depsite repeated full system scans, AVG doesn't seem to be able to get to the root of the problem, because it keeps popping up again with depressing regularity. I haven't noticed much system performance degradation as yet, although, Windows informs me that "unauthorised changes" have been made which will prevent me from getting updates, and indeed this is now the case. Also, once I was informed Windows DNS controls are not working properly and had to be shut down. But the next time I started up the problem seemed to have gone away. I've done a couple of web searches and this particular nasty seems to be a new one on most people. There are only a few other hits that Google returns to the search string "BackDoor.Generic11.ZNE" - one of them is an unanswered post on this very forum, in fact, just yesterday. The others are all on French or German-language forums, which isn't much help to me as I'm one of those awful monoglot Anglophones, but again they're dated very recently. Any help much appreciated. Fraid I'm new to this business so I am not sure what system information you are likely to need. As a starting point, here's the basics: Windows Vista HomePremium Processor: Intel® Core™2 Quad CPU Q6600 @2.4GHz Memory(RAM): 3.00GB System Type: 32-bit Operating System Thanks in advance, |
 |
 
|
Posts in this topic
Fanfaronade BackDoor.Generic11.ZNE Jul 4 2009, 04:56 AM
rigel Hi and welcome to BleepingComputer :thumbup2:
L... Jul 4 2009, 11:49 AM smithers357 I have the same exact issue on my desktop. AVG Res... Jul 7 2009, 08:49 PM tpr20 Sorry~ Jul 9 2009, 10:26 PM master131 You must start a new topic if you are going to do ... Jul 9 2009, 10:45 PM
smithers357 my apologies! I'm new to the site and didn... Jul 11 2009, 11:02 AM  |
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 9th February 2010 - 03:08 PM |
© 2003-2010 All Rights Reserved Bleeping Computer LLC.