Mean little trojan was found on my PC

[Larry_OHF]

I ran my weekly virus scan and Avast foundd something that made it through all my operating detections, until now. It was called "erikxx.chm", and it was an "online.exe". I tried to get Avast to delete it but the error message said that it was a shared file, and could not. Then I just deleted it off the location with just a Right-click and delete command. It went away, but Avast also discovered that it was in my Outgoing Box all of the sudden. Avast stopped it from retreating, and I was able to delete it from the Outgoing box. What I forgot to do before restarting the PC was to delete the deleted folder. Since I did not, erikxx found his way back onto the C drive. I deleted him from the deleted folder and the C drive again, and restarted. He is gone for good.

Funny thing, though...is when I decided to look at what he was, I clicked on it to actually run the exe. It only came up with some kind of help screen that had nothing going on. I checked my running operations, and there was nothing there. I checked the startup menu and there was nothing there. By all appearances, this thing was dormant. I did a Google on it, but found no information directly related to it, though I did find people on game forums who use the name ErikXX.

Anyway...It was alot easier to get rid of than I would have imagined. Avast would not delete it because it thought it did not have the permission to, but I was able to delete it with the easiest of methods.

Just freaking wierd.

Oh..I forgot one thing. When I deleted it from the C drive but did not yet know that it was trying to be sent through the Outlook outgoing...When I realized that something was in Outlook, I tried to access Outlook but I was not allowed in! I had to restore Erikxx to the C drive so that I could get into my Outlook profile...delete Erik from the folder, then delete him from the C drive, in that order.

[johnny]

You did wash your hands afterwards, right ?

[Link]

And so everything was safe and sound after all! Tune in next week for a new adventure featuring Larry and his computer!

Bye!

*Sesamestreet ending tune*

[johnny]

You're such a friendly guy Link.

[Link]

Originally posted by johnny: You're such a friendly guy Link.

I do my best

[Crynus]

If you are using your computer for anything important like moneytransactions/paypal, work etc., I'd definately recommend a format C:.

Trojans have a nasty habit of opening up previously closed ports and stuff like that to further breach your security.

Another popular feature of trojans are keyloggers to steal your passwords, so you'll probably want to change them after the format.

[ 04-15-2005, 10:56 AM: Message edited by: Crynus ]

[Larry_OHF]

Originally posted by johnny: You did wash your hands afterwards, right ?

Smart-ass!