Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Shopperz trojan in Windows 10


  • Please log in to reply
3 replies to this topic

#1 uberdorf

uberdorf

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:41 AM

Posted 12 December 2015 - 03:48 PM

I've been having recurring problems with the Shopperz trojan in Windows 10.  Each time I reinstall Windows, it comes back.  I find Shopperz by scanning Windows with ClamTK (GUI for ClamAV) from a linux partition. 

 

So last time I reinstalled Windows, I scanned after each change I made.  I started with a backup that I made yesterday from a backup I made a year ago.  This backup is basic Windows 7 that is up to date on updates as of 11 Dec 2015, Comodo Security Suite, and Chrome.  I can't think of anything else extra in the backup.  So after restoring Windows 7 from the backup, I made a linux partition and scanned Windows with ClamTK.  Windows 7 was clean.  Next I upgraded to Windows 10 without visiting any webpages or installing anything else, and scanned again.  This time ClamTK found the Shopperz trojan.  So I'm wondering if Microsoft made a change to dnsapi.dll that is just enough of an intrusion to register as Malware?  I also tried scanning the Windows 10 partition with Comodo for Linux, and it came up clean.  So it is just ClamAV that is finding Shopperz malware in Windows 10.

 

Here is the path and ID of the trojan from ClamTK, I just stop the scan after the first trojan is found since it takes several hours to finish...

/media/scott/eMachines/Windows/System32/dnsapi.dll      Win.Trojan.Shopperz-154   



BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,680 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:41 AM

Posted 12 December 2015 - 06:20 PM

Welcome aboard p22002758.gif

 

dnsapi.dll infection will require elevated help.

 

Please follow the instructions in THIS GUIDE starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it HERE. Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 uberdorf

uberdorf
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:41 AM

Posted 12 December 2015 - 07:16 PM

Thank you for the response.  I have followed the steps and accidentally double posted in the Malware Removal Logs section because I kept getting errors when posting.



#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,680 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:41 AM

Posted 12 December 2015 - 09:18 PM

Someone will remove double topic :)


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users