Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Perfect Defender 2009 / Trojan.Zlob.G Alert


  • This topic is locked This topic is locked
2 replies to this topic

#1 bob919

bob919

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:38 PM

Posted 06 December 2008 - 10:39 PM

Recently i've been having some "issues" with my computer.
Every time I try to go into internet explorer or firefox, it comes up with a warning saying the following:





"Insecure Internet activity. Threat of virus attack
Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, and that can lead to

system slowdown, freezes and crashes.
Also insecure Internet activity can result in revealing your personal information.
To get full advanced real-time protection for PC and Internet activity, register your antivirus software.

We recommend you to protect your PC now and continue safe Internet browsing.

Click here to get full advanced real-time protection and continue browsing.

Continue to this website unprotected (not recommended). "





When I click, it comes up with this website: <hxxp://www.defender-review.com/?a=112>
and tells me about Perfect Defender 2009, which I have not installed because apparently it's malware.

Also, every 15 minutes or so, it comes up with a so-called "security center alert" saying the following:



"Do you want to block this suspicious software?
Name: Trojan.Zlob.G
Risk Level: High
Description: Trojan.Zlob.G is a trojan program that records keystrokes and takes screen shots of the computer, stealing personal and financial

information."



Then theres three buttons Keep Blocking, Unblock, Enable Protection.

The only Button that you can click on is enable protection...which asks me to download Perfect Defender 2009, which I obviously haven't

downloaded.

I've run updated versions of AVAST, AVG, Antispyware, MalwareBytes Anti-Malware and MalwareBytes RogueRemover, which, with the exception of

rogueremover have all yielded results, and removed them, but none have them have solved the problem. They've just removed other adware and

spyware I wasn't aware of.

Here's my HijackThis Log, any help would be much appreciated, I've been up for nearly 2 days trying to sort this out!
I've also included my last "SuperAntiSpyware" scan log. All files were said to have been deleted and quarantined.
Thanks

Attached Files


Edited by Orange Blossom, 11 February 2013 - 02:45 AM.
Deactivate link. ~ OB


BC AdBot (Login to Remove)

 


#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:38 PM

Posted 08 December 2008 - 04:08 AM

Hi,

Please don't attach your logs.

I know what the cause of this infection is and how to remove it - however, I want you to check / analyse something for me, this to find out how this one behaves in normal mode - if it's visible or not - and what is the easiest method to remove it... This so I can write a tutorial about this.

Please only perform my steps, don't try anything else on your own, as this may be confusing to find out how this one exactly behaves.

Please set your system to show all files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Then, navigate to the following folder:

C:\Documents and Settings\{username}\Application Data\Google

Let me know if that folder is present / visible and what files are present in there.

Also, can you tell me what other problems you are noticing? Does your IE freeze? Your Firefox Freeze? What happens if you go to start > run and type: msconfig ? Does it give an error? All this information is important for me. :thumbsup:

Also, do you know how you got infected? Was this while browsing? Can you still remember what site? Because I know that this infection installs itself while visiting a certain site. Then suddenly a dosprompt appears and installs the infection.

Anyway, the more info you can give me, the better :)
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:05:38 PM

Posted 18 December 2008 - 12:24 PM

Due to the lack of feedback, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users