Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan.zlob-x.a


  • This topic is locked This topic is locked
5 replies to this topic

#1 juventusfc

juventusfc

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:01:32 PM

Posted 30 November 2007 - 03:28 AM

Hi!

I've gotten an error (pop-up) telling me that my computer is infected with "Trojan.Zlob-X.a" and the error also asks me to download a antivirus to scan the computer. I always pressed cancel when the notice came up. I also noticed that in my google searches, there is a youtube porno link that is displayed in the search results and the first few seach results are misleading links. Anyway, i restarted my computer and everything seemed to be alright from there on. I didnt get the pop-up telling me that my computer is infected and my google search results are now normal. I just would like to know if i should still be worried about this error that i continuesly got or is it done with? Also i would like to note that when i started getting the notice (pop-up), i just continuesly pressed cancel and i ended up restarting my computer about 1 hour after the first pop-up i recieved. The restart seemed to solve my problem but i would just like to make sure.

Thanks.

BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,579 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:32 AM

Posted 30 November 2007 - 03:32 AM

Have you done any antivirus and antispyware scans? If so, do they come up clean?
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 AzureEd

AzureEd

  • Members
  • 22 posts
  • OFFLINE
  •  
  • Local time:01:32 PM

Posted 30 November 2007 - 11:17 AM

Yeah, Like Budapest said..Check your hard drive with scans..Malware shouldnt disappear for no reason.

#4 juventusfc

juventusfc
  • Topic Starter

  • Members
  • 14 posts
  • OFFLINE
  •  
  • Local time:01:32 PM

Posted 30 November 2007 - 11:31 AM

yea i've done done both a Norton scan and an Adaware scan and they both came up clean.

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,763 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:32 PM

Posted 30 November 2007 - 02:29 PM

Trojan.Zlob-X.a is related to a SmitFraud infection. This is a generic description for a family of rogue applications/trojans such as Win32.Zlob that uses misleading advertising, downloads rogue security products, changes (hijacks) the Windows Desktop and drops additional malware infected files. The Trojan uses bogus security warnings and fake alerts to indicate that your computer is infected with spyware or has critical errors. SmitFraud is responsible for downloading and installing programs that purport to scan for spyware and then uses false scan reports as a scare tactic to goad you into purchasing one of several rogue programs to fix it.

To make sure its completely gone, if your using Win XP or 2000, please print out and follow the generic instructions for using SmitfraudFix in BC's self-help tutorial "How to remove the Smitfraud/Generic Zlob".
(scroll down to Removal Instructions; ignore the part showing symptoms in a HijackThis log as they may not apply in your case.)
If you have downloaded SmitfraudFix previously, please delete that version and download it again as the tool is frequently updated!

Then download and scan with SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)
  • Under "General and Startup", make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Under "Configuration and Preferences", click the Preferences button.
  • Click the Scanning Control tab.
  • Under Scanner Options make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Click Close to exit the program.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,763 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:32 PM

Posted 07 December 2007 - 09:48 AM

I have moved your Hijackthis log to the Misplaced HJT Logs forum. You posted your log in a forum not intended for these logs analysis and probably missed the directions we provide to those who require assistance.

Your log can be found here.

Please follow all directions that I posted as a reply to your log. Following these instructions will ensure that your hijackthis log is properly posted so it can be reviewed in a timely manner.

If you have any questions please respond in that thread. To avoid confusion, I am closing this topic.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users