Hey guys.

I Just scanned my pc with Trend micro Housecall (online scanner)

My pc found 2 trojan's
1 got removed and the other can't

its called TSPY_SINOWAL.TR

I want to remove it manually but can find the file itself (used search too)

I wanted to know how to remove it?
I read what this trojan does and it doesnt feel good.


This spyware is a DLL component dropped by TSPY_SINOWAL variants.
It is injected into various running processes in order to achieve memory-residency.
It steals account-related information from the affected system. It does the said routine by logging keystrokes and then sending all gathered information to a predetermined email address via its own Simple Mail Transfer Protocol (SMTP) engine.
This routine risks the exposure of the user's account information, which may then lead to the unauthorized use of the stolen data.


And i guess that this Trojan isnt running?

It will be really helpfull if there was a program that only remove's file's like this.

Rick

Jesus, you have lot of unneeded crap running, but no Antivirus ???

Now install avast or antivir (this seem to be improved a lot in last 6 months, however not sure if it is free anymore)


www.avast.com is where avast is, don't remember antivir, google is your friend.

Then update antivirus of your choice and run full scan removing everything it finds.

Try also www.evido.net antispyware solution, could do wonders for your system.

Small guidelines, tool bars are bad, those are from hell, there is perfect alternatives for quicktime and real player that don't need processes to be run whole time.

I don't know how is net in your place, but in here we get automatic ip-addresses and if hijack this shows nameserver being something, then usually that is some kind of hijacker and one should remove those entries.


Well, try with those first

Simply I dont use any Antyvirus things.

I already scanned my PC with AD-aware SE personal.

I'm now downloading Avast.

and thank you for your fast reply.

Quote from Takumi_lfs :

Simply I dont use any Antyvirus things.

I already scanned my PC with AD-aware SE personal.

I'm now downloading Avast.

and thank you for your fast reply.

Well, if you are not going to use such programs, then you are not getting rid of those bastards either.

Browsing internet without anti virus software is like having sex with commercial lady without protection, you never know what surprises you afterwards

Quote from JTbo :

Well, if you are not going to use such programs, then you are not getting rid of those bastards either.

Browsing internet without anti virus software is like having sex with commercial lady without protection, you never know what surprises you afterwards

Nice comparison!

Takumi, you should really get some antivirus software on there. Or you could find yourself with something alot worse than a Trojan.

Apparently there's nothing particularly suspect in the log. You should perform another scan with HouseCall and compare the results to the previous scan.

The only way to be sure about the presence of malware would be analysing each running process and each autorun object (legitimate or not) using additional software. Process Explorer and Autoruns by Sysinternals are exceptionally well made for a thorough manual inspection.

If you suspect the file is hidden because of a rootkit, use an antirootkit. AVG, Sophos and F-Secure (Blacklight) provide one-click solutions. They're not the best, but sometimes they're enough. Attributes and permissions may be another cause of 'invisibility'. Be sure to show all files, included hidden ones.

Quote from JTbo :

Browsing internet without anti virus software is like having sex with commercial lady without protection, you never know what surprises you afterwards

Well since the rest of the family started using a newer computer I've exclusively used this PC and not had 1 virus or piece of spyware in 3 years of not running any virus scans, I usually run an Avast scan each time I re-install Windows on the other PC, which I think I've probably done about 7 times. It's not as though this computers web browsing is squeeky clean I just use Firefox and when I come across an un-exploded nuclear warhead I don't poke it with a stick.

Quote from ajp71 :

Well since the rest of the family started using a newer computer I've exclusively used this PC and not had 1 virus or piece of spyware in 3 years of not running any virus scans, I usually run an Avast scan each time I re-install Windows on the other PC, which I think I've probably done about 7 times. It's not as though this computers web browsing is squeeky clean I just use Firefox and when I come across an un-exploded nuclear warhead I don't poke it with a stick.

So you are basically saying that you are using only clean commercial womens, why does this bring smile to my face?

Firefox is not fail proof either and lets not get started with email and attachments of it

Quote from JTbo :

Firefox is not fail proof either and lets not get started with email and attachments of it

Well G-Mail and Hotmail both seem pretty bullet proof. I use G-mail for writing e-mails and find it far more convenient than e-mail programs which seem to be a more likely weak point. I don't use the tightest security settings in Firefox.

TBH I think an anti-virus scanner offers about as much protection as wearing a rubber glove in a tank of piranhas, just don't push your luck and you'll be fine

Quote from ajp71 :

Well G-Mail and Hotmail both seem pretty bullet proof. I use G-mail for writing e-mails and find it far more convenient than e-mail programs which seem to be a more likely weak point. I don't use the tightest security settings in Firefox.

TBH I think an anti-virus scanner offers about as much protection as wearing a rubber glove in a tank of piranhas, just don't push your luck and you'll be fine

Good anti virus is working actively at background and does not let anything harmful to enter your HDD, that is the idea, however for example f-secure works completely wrong way, it let's stuff to HDD and then tries to remove it, however file is in use and cannot be removed is more of rule than exception with it.

You can't predict what will come up from internet, those banners there tend to contain all kind of crap, there is new company every second so ad blockers are not perfectly effective, shitty part is you don't need to click anything, it is when you see it you get it, with IE even worse than with firefox, but one should not believe Firefox would be immune, there is some pests designed directly for firefox and there will be more in future.

Game reviews and cheats providing sites seem to have all kind of this crap on their websites, some are even not banners but like in megaupload there is some popups doing things to your machine you don't like if you don't cripple your browser to stone-age, really sad how it is.

Almost the same case as with ajp71 here - after using the computer with everyone in the family without any means of anti virus there have been 4 viruses. The PRIMARY trick of keeping yourself clean is BROWSING USING AN USER ACCOUNT. The SECONDARY trick is use a good web browser - currently Opera is the best in most means, it's the fastest way ahead of others on Windows (not so good on other OS's tough). And it has way less security bugs, and those bugs get fixed quickly. (Firefox has had about 30 this year with 10 still not fixed, Opera has had 6 and all of them have been fixed and none of them have been major)

A good antivirus traps some kernel calls modifying the NT System Service Descriptor Table. For instance Kaspersky traps NtClose, NtCreateProcess, NtCreateProcessEx, NtCreateSection, NtOpenProcess, NTQueryInformationFile, NtSetInformationProcess and NtTerminateProcess to handle them with the driver klif.sys. All these kernel calls are usually handled by ntoskrnl.exe, but in case of Kaspersky the SSDT is manipulated and extended to offer the functionality needed to open the file, check it and pass it back to the operating system if clean.

This is the way most antiviruses work these days. It's fairly easy to check this, just run a simple antirootkit like IceSword and check the SSDT.

This metodology is used also by some rootkits.

There are some additional possible checks, such as the usage of an LSP to scan network traffic for incoming malware. Such technique is used for instance by Microworld E-Scan, which is based on Kaspersky Engine but adds an interesting and sometimes annoying feature called Winsock Layer. They say it prevents malware from entering blocking the relative network traffic, but that doesn't work always.

It doesn't matter if you have an Anti Virus or not because if you don't know where you keep getting them from an Anti Virus will never tell you that, unless the name of the virus/spyware, is linked in name to a website you went on.

If you keep persisting to go on HACKING sites, to get one up on your friends and lans, just think about it. And think about the Horsey you got last week k?

LOL, I just Bootscanned my PC with AVAST. Is detected some nice infected files by the Trojan???

Anyway because I and USB keyboard i couldnt press any keys and damn i waited 5 hours for that.

I'm gonna scan my PC again but not the Boot-scan.

Quote from Takumi_lfs :

LOL, I just Bootscanned my PC with AVAST. Is detected some nice infected files by the Trojan???

Anyway because I and USB keyboard i couldnt press any keys and damn i waited 5 hours for that.

I'm gonna scan my PC again but not the Boot-scan.

Set boottime scan to automatically delete or enable USB legacy support from bios, I have usb keyboard and mouse and no trouble at all

Quote from JTbo :

Browsing internet without anti virus software is like having sex with commercial lady without protection, you never know what surprises you afterwards

Antivirus is more akeen to going to the doctor and asking for a shot against every known virus or disease. You'd then be weighed down by the extra 5 pints of fluid in your system.

ah nvm, im already scanning it (thorough scan).

Anyway good prog. I'll ask my dad to buy it.

Quote from Takumi_lfs :

ah nvm, im already scanning it (thorough scan).

Anyway good prog. I'll ask my dad to buy it.

You don't need to, it is free for home use, also light and efficient

well, but why did it ask me to write a licence code then?

and why 59 days left?

Quote from Takumi_lfs :

well, but why did it ask me to write a licence code then?

and why 59 days left?

IIRC you have to register at their website to get the activation code for the free version. It's either that or you've downloaded one of their commercial products.

Quote from ajp71 :

IIRC you have to register at their website to get the activation code for the free version. It's either that or you've downloaded one of their commercial products.

Downloading Avast home free version, then support -> avast home registration and he should be okay, supplied with code that gives 1 year license, then after one year do it again and another year license, I have used 2-3 years now and even I have not paid anything their support is A1 if one needs it

Quote from JTbo :

Downloading Avast home free version, then support -> avast home registration and he should be okay

The best thing in Avast is that's free. Their virus database is odd and fails to locate lots of trojans. I'd go with Avira Antivir if I had to choose a free antivirus, it does a better job.

Kaspersky remains my antivirus of choice, and the most respected one by people who have an interest in fighting malware. The Holy Father used it as a benchmark to detect his excellent rootkit, hacker defender.

Apparently the Holy Father died in a road accident last year, but I didn't check if this is only a rumour. The old homepage is unavailable. The old presentation he made for hxdef is still on YouTube.

Quote from Takumi_lfs :

Simply I dont use any Antyvirus things.

that's exactly what leads to problems like yours...
AVG is a good fast working antivirus software, that not only works, but also is free

Quote from squidhead :

that's exactly what leads to problems like yours...

This isn't quite right. You can perfectly live without an antivirus, but you have to understand what you're doing and accept the fact you have to manage security proactively on your own.

I for once accept the thesis of the Holy Father: the approach of most antiviruses is inherently flawed because they prevent only what they know, and this leads to a false sense of security. Nonetheless it's still a valid approach because most people don't know how to audit or manage the security of their computer. Trouble is, should they do it or not? Ideally they shouldn't do it, but OSes are far from perfect. To each his own.

Quote from Albieg :

The best thing in Avast is that's free. Their virus database is odd and fails to locate lots of trojans. I'd go with Avira Antivir if I had to choose a free antivirus, it does a better job.

Kaspersky remains my antivirus of choice, and the most respected one by people who have an interest in fighting malware. The Holy Father used it as a benchmark to detect his excellent rootkit, hacker defender.

Apparently the Holy Father died in a road accident last year, but I didn't check if this is only a rumour. The old homepage is unavailable. The old presentation he made for hxdef is still on YouTube.

Avira Antivir is indeed rather nice product nowdays, nothing like few years ago when Avast was still far superior to any other, they have been sleeping on their bearings it seems indeed, but last time I mailed to them they were quite sorry about situation and at least expressed will to improve, which is good sign, imo.

Still Avast beats Norton and F-Secure hands down, but Avira is something you could check out too. I have no long term experience with Avira (other than some old version which was really bad) so might put to one box for a test