Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Advice On Zlob.trojan


  • Please log in to reply
2 replies to this topic

#1 Pankoman

Pankoman

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:21 PM

Posted 12 May 2006 - 10:57 AM

The other day I encountered a problem browsing the internet with Firefox, some applet or something wasn't running, so I copied the URL into IE, which worked fine. A few minutes later my anti-virus and anti-spyware programs started going crazy and flashing, warning me about things trying to lower internet security settings or just general malware and stuff they'd found on my PC.

I opened up Microsoft anti-spyware and ran a full system scan, it found a trojan virus named 'Zlob', so I removed it. The warnings persisted so I scanned again and found the same trojan, so I was a little unnerved. I searched on google for guides on how to remove it, of which I found a few.

So I turned off system restore, booted my PC in safe mode, opened up NOD32 and performed as in depth a scan as the software allows and deleted everything it found (of course checking it wasn't a system critical file).

Now, back in normal mode, the warnings have cut down a lot, but according to Microsoft Anti-spyware something is still trying to lower my internet security settings every 20 minutes, so I have to keep clicking 'block'. I'm pretty sure it's not spreading and has been well contained, but I hate the thought of there being stuff like this on my PC.


Any ideas?


A rootkit revealer scan found some suspicious stuff, what do you make of this:


HKLM\S-1-5-21-1644491937-1637723038-725345543-1004\Software\Valve\Steam\Steam.exe\UpTimeMostRecent

HKLM\SOFTWARE\Eset\Nod\CurrentVersion\Modules\Imon\Settings\UserAgentList

HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg

C:\WINDOWS\Prefetch\LD7F8C.TMP-30FA89AA.pf

C:\WINDOWS\system32\1024\ld7F8C.tmp

C:\WINDOWS\Temp\_avast4_\unp34124495.tmp

C:\Documents and Settings\Tom Pankovas\Local Settings\Temporary Internet Files\Content.IE5\ARWT0T83\B1856767[1].4;sz=234x60;ord=554893543

BC AdBot (Login to Remove)

 


#2 Jacee

Jacee

    Bleeping around


  • Malware Response Team
  • 3,716 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:21 PM

Posted 12 May 2006 - 02:41 PM

Zlob is a trojan downloader. Variants of Zlob silently download and install various third-party spyware and malware scanners to infected computers: Spy Trooper, SpyAxe, Security Toolbar etc.

MS_MVP.gif
MS MVP Windows-Security 2006-2016
Member of UNITE, the Unified Network of Instructors and Trusted Eliminators

Admin PC Pitstop


#3 Jacee

Jacee

    Bleeping around


  • Malware Response Team
  • 3,716 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:12:21 PM

Posted 12 May 2006 - 02:46 PM

Pankoman, please read this link:

http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/

The HJT Team can help you get rid of it :thumbsup:

MS_MVP.gif
MS MVP Windows-Security 2006-2016
Member of UNITE, the Unified Network of Instructors and Trusted Eliminators

Admin PC Pitstop





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users