Trojan Horse BackDoor.ircbot.DFJ

sdornan7 · 02-27-2008, 02:45 PM

Does anyone know what this is? I got a pop-up on a poker site I was playing on saying someone else had logged in under my username, so I did a scan with AVG and it came up with this? AVG healed it, do I have anything still to worry about? It was in a .rar that I downloaded about 5 months ago and I've not had problems up until now. I haven't noticed anything wrong with my system. If it was a keylogger wouldn't something have happened before now? The weird thing was, earlier by mistake I typed my password into the "username" field on the poker site and it appeared on the screen then within an hour someone had tried to use it! Is it possible for someone to see my screen with a trojan like this?

Thanks for any help.

**grumpygit** · 02-27-2008, 03:27 PM

Hi,
Trojan Horse malware usually contains many nasties, including downloaders, keyloggers, etc.
If you have used this computer for anything confidential,eg.online shopping, online banking, I would suggest changing passwords and notifying anyone concerned that you think your computer security has been compromised.
If you think your computer may still be infected, follow the instructions in the link below and post your logs in the hijack this section and an analyst will check them.
You will need to be patient as they are very busy.

http://www.techsupportforum.com/secu...sting-log.html

sdornan7 · 02-27-2008, 07:23 PM

OK I've went through those steps and posted my log in the HijackThis forum, I understand though that they'll take a couple of days. In the meantime I've scanned with AVG, AdAware 2007, Spybot S&D, Kaspersky online and Panda ActiveScan and they've all found nothing after I deleted the original trojan so am I likely to be safe? I use the PC a lot for poker and I have sums of money that I need to know are safe.

* AVG has just popped up while I was typing this with the same warning as before, this time it is located within C:\System Volume Information\_restore{ (long string of letters and numbers)
I can't find this folder in my C: drive though? This warning incidentaly was while the Kaspersky scanner was scanning the same file.

Thanks for any help, I'm aware you are very busy.

**grumpygit** · 02-28-2008, 11:14 AM

Hi,
You could try downloading Snoopfree from the link below and it will warn you if any programs are trying to capture keystrokes or screenshots, but personally i would not use the computer for anything confidential until i knew it was clean and i would change my passwords just in case.

http://www.snoopfree.com/

02-27-2008, 02:45 PM	#1 (permalink)
sdornan7 Registered User Join Date: Jun 2007 Posts: 34 OS: XP	Trojan Horse BackDoor.ircbot.DFJ Does anyone know what this is? I got a pop-up on a poker site I was playing on saying someone else had logged in under my username, so I did a scan with AVG and it came up with this? AVG healed it, do I have anything still to worry about? It was in a .rar that I downloaded about 5 months ago and I've not had problems up until now. I haven't noticed anything wrong with my system. If it was a keylogger wouldn't something have happened before now? The weird thing was, earlier by mistake I typed my password into the "username" field on the poker site and it appeared on the screen then within an hour someone had tried to use it! Is it possible for someone to see my screen with a trojan like this? Thanks for any help.

02-27-2008, 03:27 PM	#2 (permalink)
grumpygit T-Shirt Winner Join Date: Oct 2006 Location: hertford, england Posts: 4,746 OS: win xp pro sp3 My System Blog Entries: 2	Re: Trojan Horse BackDoor.ircbot.DFJ Hi, Trojan Horse malware usually contains many nasties, including downloaders, keyloggers, etc. If you have used this computer for anything confidential,eg.online shopping, online banking, I would suggest changing passwords and notifying anyone concerned that you think your computer security has been compromised. If you think your computer may still be infected, follow the instructions in the link below and post your logs in the hijack this section and an analyst will check them. You will need to be patient as they are very busy. http://www.techsupportforum.com/secu...sting-log.html __________________ Grumpygit Last edited by Glaswegian; 02-27-2008 at 03:40 PM. Reason: Edited for missing link.....

02-27-2008, 07:23 PM	#3 (permalink)
sdornan7 Registered User Join Date: Jun 2007 Posts: 34 OS: XP	Re: Trojan Horse BackDoor.ircbot.DFJ OK I've went through those steps and posted my log in the HijackThis forum, I understand though that they'll take a couple of days. In the meantime I've scanned with AVG, AdAware 2007, Spybot S&D, Kaspersky online and Panda ActiveScan and they've all found nothing after I deleted the original trojan so am I likely to be safe? I use the PC a lot for poker and I have sums of money that I need to know are safe. * AVG has just popped up while I was typing this with the same warning as before, this time it is located within C:\System Volume Information\_restore{ (long string of letters and numbers) I can't find this folder in my C: drive though? This warning incidentaly was while the Kaspersky scanner was scanning the same file. Thanks for any help, I'm aware you are very busy.

02-28-2008, 11:14 AM	#4 (permalink)
grumpygit T-Shirt Winner Join Date: Oct 2006 Location: hertford, england Posts: 4,746 OS: win xp pro sp3 My System Blog Entries: 2	Re: Trojan Horse BackDoor.ircbot.DFJ Hi, You could try downloading Snoopfree from the link below and it will warn you if any programs are trying to capture keystrokes or screenshots, but personally i would not use the computer for anything confidential until i knew it was clean and i would change my passwords just in case. http://www.snoopfree.com/ __________________ Grumpygit