trojan downloader

[copakelake29]

hi all---i have windows one care and it keeps reporting it has found
trojandownloader/obvod.c and that it has been quarantineed.
i keep getting this----why doesent one care get it out of my pc or tell me
how to do it myself.
also if one care isnt enough as it seems to lead me to believe
then what else should i put on my pc to insure that i am protected from these
intrusions.
why doesnt microsoft tell us that to compliment a program we
also need this product
it seems as if everyone that sells us a product would want us
to think that BUY THIS AND YOUR ARE DONE FOR LIFE
I DONT WANT TO HARP ON THIS BUT I JUST WANT TO KNOW WHAT I
NEED THE FIRST TIME and i will do it
thanks for any guidance

 

[Kayman]

hi all---i have windows one care and it keeps reporting it has found
trojandownloader/obvod.c and that it has been quarantineed.
i keep getting this----why doesent one care get it out of my pc or tell me
how to do it myself.
also if one care isnt enough as it seems to lead me to believe
then what else should i put on my pc to insure that i am protected from these
intrusions.
why doesnt microsoft tell us that to compliment a program we
also need this product
it seems as if everyone that sells us a product would want us
to think that BUY THIS AND YOUR ARE DONE FOR LIFE
I DONT WANT TO HARP ON THIS BUT I JUST WANT TO KNOW WHAT I
NEED THE FIRST TIME and i will do it
thanks for any guidance

Windows Live OneCare has failed to live up its promise...it is a dud! I'd
uninstall/remove it from the operating system and (if you're an average
homeuser) download/install good-quality freeware.

Though you didn't mention your operating system, my suggestions will suit
both WinXP and Vista.

1.Utilize (re-activate the build-in firewall application. If you're on XP
use this nifty application as well:
Seconfig XP 1.0
http://seconfig.sytes.net/

2.Avira AntiVir® Personal - FREE Antivirus (resident real-time apps)
http://www.free-av.com/
(The free version won't scan your emails.)
Unless you are using Microsoft Outlook or Lotus Notes (MAPI or VIM),
scanning email is worthless.
Why You Don't Need Your Anti-Virus Program to Scan Your E-Mail
http://thundercloud.net/infoave/tutorials/email-scanning/index.htm
Ensure your e-mail program is configured to display e-mail messages in
'Plain Text' only.
You may wish to consider removing the 'AntiVir Nagscreen'
http://www.elitekiller.com/files/disable_antivir_nag.htm

3.Windows Defender - Free (build-in in Vista) - resident real-time apps.
http://www.microsoft.com/athome/security/spyware/software/default.mspx
WD monitors the start-registry and hooks registers/files to prevent spyware
and worms to install to the OS.
Interesting reading:
http://www.pcworld.com/article/id,136195/article.html
"...Windows Defender did excel in behavior-based protection, which detects
changes to key areas of the system without having to know anything about
the actual threat."

To solve your problem:
1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Click 'Start' and then click 'Run...' then type (or copy/paste) "cleanmgr"
(w/out quotation marks into the box, then click the 'OK' button. Select
your drive
(presumably WinXP (C and click OK.
--or--
2a.Delete files using Disk Cleanup (if on Vista)
http://windowshelp.microsoft.com/Windows/en-US/help/1264bc24-72a8-48aa-84e3-a355327139d91033.mspx

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE
--and/optional--
Kaspersky® Virus Removal Tool
http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
http://www.kaspersky.com/support/viruses/avptool?level=2
--and/optional--
Dr.Web CureIt!® Utility - FREE
http://www.freedrweb.com/cureit/
--and/optional--
a-squared Free or a-squared Command Line Scanner
http://www.emsisoft.com/en/software/download/
--and/optional--
BitDefender10 Free Edition (*NOT FOR VISTA*)
http://www.bitdefender.com/site/Downloads/browseEvaluationVersion/1/42/

NOTE:
Kaspersky® Virus Removal Tool, Dr.Web CureIt!®' the free version of
Malwarebytes© and SuperAntispyware are not capable for real-time protection
of your computer.
Kaspersky® Virus Removal Tool, Dr.Web CureIt!® have no update feature (so
they don't turn into full blown scanners). As soon as your computer is
cleaned you are supposed to remove these tools from your operating system
and revert back to your (updated) resident (real-time) AV application.
Re: Kaspersky® Virus Removal Tool; To uninstall/move this program 'enable
self-defense' must be unchecked!

The free version of Malwarebytes© and SuperAntispyware have an update
feature, keep them installed in addtion to your resident AV/A-S
applications and scan frequently.

To scan your computer with the most up-to-date Kaspersky® AVPTool and
Dr.Web CureIT!® virus databases next time you should download new
Kaspersky® AVPTool and Dr.Web CureIt!® packages.

4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Good luck

 

[Bill Sanderson]

Windows Live OneCare takes care of two of the three recommendations you've
made below: It includes Windows Defender, and it has it's own firewall
application which has additional features beyond those in the basic Windows
Firewall included in Windows XP SP2 and Vista.

I'd agree with you that it hasn't done the job that the antivirus portion
should do in this case, but my own suggestion would be to restart in safe
mode and run a scan and clean the system in that mode. Alternatively,
Windows Life OneCare comes with live support staff--and calling them might
well get this resolved more quickly than running through a long list of
alternatives.

I'd recommend learning more about the product before declaring it a
dud--although, since Microsoft has announced that OneCare will be
discontinued after existing subscriptions lapse during the coming year,
there isn't much time to do that!

Existing subscribers should visit the OneCare forums for more accurate
information, but there will be a replacement antivirus product available
from Microsoft, and it will be free.

--

 

[Kayman]

Windows Live OneCare takes care of two of the three recommendations you've
made below: It includes Windows Defender, and it has it's own firewall
application...

/If/ he follows my recommendation then he should proceed as per points #1,
#2 and #3.

...which has additional features beyond those in the basic Windows
Firewall included in Windows XP SP2 and Vista.

Let's don't get into the "additional features" this software application is
comprised of.

I'd agree with you that it hasn't done the job that the antivirus portion
should do in this case,

Hence my original recommendation.

but my own suggestion would be to restart in safe mode and run a scan and
clean the system in that mode.

Even though "that it hasn't done the job that the antivirus portion"...?
But then again, many roads lead to Rome

Alternatively, Windows Life OneCare comes with live support staff--and
calling them might well get this resolved more quickly

More quickly? You're joking, right?

than running through a long list of alternatives.

Let's dissect this claim.
#1 and #2 are essential maintenance requirements.
#3 are downloaded/updated/executed in about 1 hour and most probably "clean
up" his os.
Optional is was the term implies.
#4 makes good sense to implement; Not even a "live support staff" would be
able to examine the op's os the HJT does!

Aside from this, it is also an educational exercise for the op.

I'd recommend learning more about the product before declaring it a
dud--

Why bother? It's time to move on.

although,

Back paddling?

since Microsoft has announced that OneCare will be discontinued after
existing subscriptions lapse during the coming year, there isn't much time
to do that!

The AV part has improved, the rest is utterly useless and unimaginative (a
failed marketing plot)---The users have spoken!

Existing subscribers should visit the OneCare forums for more accurate
information, but there will be a replacement antivirus product available
from Microsoft, and it will be free.

LOL, as if the marketing people of MSFT would provide 'accurate'
information. Heck, the they don't even listen to their own program
engineers.

 

[Bill Sanderson]

In line:
--

/If/ he follows my recommendation then he should proceed as per points #1,
#2 and #3.


Let's don't get into the "additional features" this software application
is
comprised of.

I wasn't--I meant the firewall which I think most would feel is "better"
than the standard Windows firewall because it looks at outbound traffic as
well as inbound.

Hence my original recommendation.


Even though "that it hasn't done the job that the antivirus portion"...?
But then again, many roads lead to Rome

The antivirus had alerted about the infection, but wasn't able to clean it.
It is more likely able to clean it in safe mode.

More quickly? You're joking, right?

Calling Microsoft ought to get this taken care of in the course of a single
call--with no need to post back to a newsgroup and wait for a response.
This might or might not be faster than your alternatives, which I agree are
comprehensive, and should take care of the problem--but depending on the
skill and background of the poster, may take some time to get through.

Let's dissect this claim.
#1 and #2 are essential maintenance requirements.
#3 are downloaded/updated/executed in about 1 hour and most probably
"clean
up" his os.
Optional is was the term implies.
#4 makes good sense to implement; Not even a "live support staff" would be
able to examine the op's os the HJT does!

Aside from this, it is also an educational exercise for the op.

Agreed--and that is good.

Why bother? It's time to move on.


Back paddling?

No--but if I post something like that, I have to assume that a large number
of silent readers will read it--so it would be wrong to just say that and
not say anything more about Microsoft's future plans, little as I know about
them...

The AV part has improved, the rest is utterly useless and unimaginative (a
failed marketing plot)---The users have spoken!


LOL, as if the marketing people of MSFT would provide 'accurate'
information. Heck, the they don't even listen to their own program
engineers.

The OneCare forums are "staffed" by peers--i.e. other users, just as this
group is. As far as I'm aware, the marketing staff don't post in any
support forums, but perhaps I'm misjudging them.

I didn't mean to get into a fight about this--but I do think that
Microsoft's anti-malware efforts--Windows Defender, the Malicious Software
Removal tool, OneCare, and Forefront, are both innovative and
effective--without making a lot of in-your-face splash.

Since OneCare has identified the critter, I suspect it can also clean it
relatively easily-and a call to Microsoft should get the job done without
the use of all those third-party tools. On the other hand, I agree with you
that they would provide an educational opportunity. Either way, what we are
both trying to do is get the OP's system clean.

 

[Kayman]

I wasn't--I meant the firewall which I think most would feel is "better"
than the standard Windows firewall because it looks at outbound traffic as
well as inbound.

That's debatable.
Managing the Windows Vista Firewall
http://technet.microsoft.com/en-us/magazine/cc510323.aspx
Scroll down to:
How Much Security Can Outbound Filtering Provide?

The antivirus had alerted about the infection, but wasn't able to clean it.
It is more likely able to clean it in safe mode.

It's possible, I didn't disagree.

Calling Microsoft ought to get this taken care of in the course of a single
call--with no need to post back to a newsgroup and wait for a response.
This might or might not be faster than your alternatives, which I agree are
comprehensive, and should take care of the problem--but depending on the
skill and background of the poster, may take some time to get through.


Agreed--and that is good.


No--but if I post something like that, I have to assume that a large number
of silent readers will read it--so it would be wrong to just say that and
not say anything more about Microsoft's future plans, little as I know about
them...

I don't disagree. But I honestly didn't think calling this software a dud
would raise eyebrows. The way I interpret dud is a flop i.e. an application
fails badly or is ineffectual. Would there be another reason for MSFT to
remove this program, I wonder?

Well, the op hasn't. Judging from his post (capital letters etc.) he is
desperately looking for immediate assistance. My suggestions will solve
the challenges he is experiencing.

Yes, let's hope it compares favorably with the existing (big) 3
"good-ones". And I hope the new application isn't limited to viruses but
encompasses all malware (a trend other makers of specialized software
pursuing vigorously). A combo of both a refined version of MRT and the
"replacement AV product" would be ideal, IMO.

The OneCare forums are "staffed" by peers--i.e. other users, just as this
group is. As far as I'm aware, the marketing staff don't post in any
support forums, but perhaps I'm misjudging them.

Several contributors with signature ending MSFT posting here and other MS
groups infrequently.

I didn't mean to get into a fight about this--but

I honestly can't see the relevance other than my style of writing may be
straight-forward and to the point; If you construe this as an attack to you
personally than don't! Nor should it be seen as an attack towards MSFT
either! (War, what is it good for...absolutely nothing!

I do think that Microsoft's anti-malware efforts--Windows Defender,

A good real-time anti-spy (A-S) application. I suggest adding the free
version of SUPERAntiSpyware and Malwarebytes (on-demand scanners) because
the effectiveness of an individual A-S scanners can be wide-ranging and
oftentimes a collection of scanners is best. There isn't one software that
cleans and immunizes you against everything. That's why you need multiple
products to do the job i.e. overlap their coverage - one may catch what
another may miss.

the Malicious Software Removal tool,

It's a good tool but it has a limited malware target list. IMO, it should
definitely be used on Patch Tuesdays. But since infective agents
change/evolve continuously, later scans with MRT may not be effective.
MRT is much like McAfee's Stinger. It has a limited sub-set target list.
The on-demand scanners I suggested have a super-set of targeted infective
agents.

OneCare,

No comment

and Forefront, are both innovative and effective--without making a lot
of in-your-face splash.

Would you recommend Forefront to an average homeuser operating a single
desk-top/lap-top?

Since OneCare has identified the critter, I suspect it can also clean it
relatively easily-and a call to Microsoft should get the job done without
the use of all those third-party tools. On the other hand, I agree with you
that they would provide an educational opportunity. Either way, what we are
both trying to do is get the OP's system clean.

Happy belated New Year

 

[Bill Sanderson]

And a Happy new year to you as well!

No, Forefront isn't something the average user can install, although the
forefront client is very much what I would have preferred that OneCare
looked like--and in general, I think it evolved in that direction--i.e. less
in-your-face.

I can see the conflict, though--I want an antivirus app that just sits there
and does its job and doesn't bother me unless there is an action or decision
I need to make. The competition tends to brag about how much stuff it is
catching or keeping out or whatever.

Maybe some amount of that bragging or needless self-congratulation about
keeping stuff out is needed for folks to be impressed by the effectiveness
of the product and talk it up to their friends.

I think it is unlikely that OneCare's demise was due to ineffectiveness as
an anti-malware product. It did quite well in recent testing.

http://www.av-comparatives.org/seiten/ergebnisse/summary2008.pdf


More likely, it simply wasn't a marketing success. Alternatively, perhaps
the situation is now ripe for Microsoft to be able to provide a free
antivirus solution when that would have raised an anti-competitive storm
back when OneCare came out. I doubt there is anybody able to speak to this
though, so I don't know how we'd ever settle the question.

The folks who post here with MSFT after their names are technical folks.
How much they know or are able to say about the marketing side of the
picture I've no idea.

As to the comprehensivness of Morro--nows the time to make suggestions. I
would favor continuing the Malicious Software Removal tool releases, myself,
because I think they reach folks that the free apps--Windows Defender, and
whatever Morro will be called, won't--including folks with pirated versions
of Windows.

--

 

[Engel]

The folks who post here with MSFT after their names are technical folks.

The abbreviation MSFT is = Most Secure Firewall Tester? Or what.

Thank Bill.
-=-

 

[Kayman]

And a Happy new year to you as well!

Thank you.

I think it is unlikely that OneCare's demise was due to ineffectiveness as
an anti-malware product. It did quite well in recent testing.

Agree, the AV product has improved considerable since inception and may be
equal to but certainly not better than the free versions of Anti-Vir, Avast
and AVG; Not to mention the availability of numerous good-quality off-line
on-demand scanners.

IMO, the demise is due to the fact as stated above including the really
pointless additions OneCare is providing because *everything* offered
within this package can be obtained freely and legally! IMO, MSFT
(marketing) insulted the users intelligence; They should've known better!

As to the comprehensivness of Morro--nows the time to make suggestions. I
would favor continuing the Malicious Software Removal tool releases, myself,
because I think they reach folks that the free apps--Windows Defender, and
whatever Morro will be called, won't--including folks with pirated versions
of Windows.

I noticed the press release, sounds promising!