Backdoor.Win32.Troffer.2, help required

auntiej · 06-02-2008, 08:49 AM

hi, I just switched on my computer and Kaspersky AV started to update. Suddenly one of their red messages screeched telling me that Backdoor.Win32.Troffer.2, running module aawservice.exe\avalicense.dll was on my computer. I was offered the option to delete, I clicked Delete. Kaspersky neutralised ("all threats successfully neutralised") the threat and placed a copy in their Backup. I decided to do a full scan, again the message came up telling me of another infection, exactly the same name, again I chose delete. Can anyone help with this at all? I just did a google search on the name and nothing was found. If they neutralised the threat why did another infection appear straight after? Any help gratefully received.

**amateur** · 06-02-2008, 11:54 AM

Hello and welcome to TSF

Please read this sticky: If you think your computer is infected....

If you cannot complete any of the 5 steps for whatever reason, just continue on with the next one until they are all completed, and post your logs in The HJT Help Forum; where an Analyst will assist you. However, it is very important to make mention of any of the steps that you were not able to complete.

Please note that the HijackThis forum is very busy and it may take some time to get a reply.

auntiej · 06-03-2008, 07:32 AM

hi, thanks for your reply. I have run a PandaScan, and enclose report herewith. It found an infection, and I clicked the disinfect button as required. I have downloaded Spyware Blaster, but was unable to download Deckard System Scanner - The box opened but the Save button was greyed out, only the Cancel button remained. I am using an account with admin privileges. When I logged on to my pc today Kaspersky once again reported the backdoor Trojan, even though Panda had disinfected the infection it found and KAV deleted to incidents of the trojan yesterday. Thanks for continued support.

auntiej · 06-03-2008, 07:58 AM

further to above, if it is of any help I have run a Hijack This scan, which I attach.

**amateur** · 06-03-2008, 12:11 PM

Hi,

This is a general security forum, hence the logs are not analyzed here, but at the HJT Help forum mentioned in my above post. However, at a quick glance I don't see any malware present.

auntiej · 06-04-2008, 03:11 AM

Thanks, Amateur, for your kind help. I am asking a mod to transfer to HJT forum. So this is a kind of To Whom It May Concern!!
Does anyone have an idea why I could not download DSS, and also has anyone heard of the trojan in my first post. The word Troffer is possibly I think Iroffer.
Also why is it that everytime I switch on, Kasp AV tells me the pc is infected, I click neutralise and assume all is ok, and next day it happens again? Could I search for the file in aawservice.exe and delete it. Should I remove the copy of Kaspersky I have and redownload?
Thanks for any information that can be supplied.

**amateur** · 06-04-2008, 05:54 AM

Hi,

I see that you have posted at the HijackThis sub forum. Please make sure that you read this sticky and complete all the steps therein and post the required logs. If you are not able to do any of the steps, please move on to the next until you complete all 5 of them and report which step you were unable to complete.

http://www.techsupportforum.com/secu...oval-help.html

Also note that the HijackThis section of the forum is very busy and it may take a while before an analyst can reply to you. So, please be patient.

Good luck.

06-02-2008, 08:49 AM	#1 (permalink)
auntiej Registered User Join Date: Aug 2006 Posts: 268 OS: xp	Backdoor.Win32.Troffer.2, help required hi, I just switched on my computer and Kaspersky AV started to update. Suddenly one of their red messages screeched telling me that Backdoor.Win32.Troffer.2, running module aawservice.exe\avalicense.dll was on my computer. I was offered the option to delete, I clicked Delete. Kaspersky neutralised ("all threats successfully neutralised") the threat and placed a copy in their Backup. I decided to do a full scan, again the message came up telling me of another infection, exactly the same name, again I chose delete. Can anyone help with this at all? I just did a google search on the name and nothing was found. If they neutralised the threat why did another infection appear straight after? Any help gratefully received.

06-02-2008, 11:54 AM	#2 (permalink)
amateur Moderator, Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: USA Posts: 7,463 OS: XP SP3	Re: Backdoor.Win32.Troffer.2, help required Hello and welcome to TSF Please read this sticky: If you think your computer is infected.... If you cannot complete any of the 5 steps for whatever reason, just continue on with the next one until they are all completed, and post your logs in The HJT Help Forum; where an Analyst will assist you. However, it is very important to make mention of any of the steps that you were not able to complete. Please note that the HijackThis forum is very busy and it may take some time to get a reply. __________________ My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006

06-03-2008, 12:11 PM	#5 (permalink)
amateur Moderator, Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: USA Posts: 7,463 OS: XP SP3	Re: Backdoor.Win32.Troffer.2, help required Hi, This is a general security forum, hence the logs are not analyzed here, but at the HJT Help forum mentioned in my above post. However, at a quick glance I don't see any malware present. __________________ My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006

06-04-2008, 03:11 AM	#6 (permalink)
auntiej Registered User Join Date: Aug 2006 Posts: 268 OS: xp	Mod: cld you transfer to HJT? Re: Backdoor.Win32.Troffer.2, help required Thanks, Amateur, for your kind help. I am asking a mod to transfer to HJT forum. So this is a kind of To Whom It May Concern!! Does anyone have an idea why I could not download DSS, and also has anyone heard of the trojan in my first post. The word Troffer is possibly I think Iroffer. Also why is it that everytime I switch on, Kasp AV tells me the pc is infected, I click neutralise and assume all is ok, and next day it happens again? Could I search for the file in aawservice.exe and delete it. Should I remove the copy of Kaspersky I have and redownload? Thanks for any information that can be supplied.

06-04-2008, 05:54 AM	#7 (permalink)
amateur Moderator, Analyst, Security Team ; Rangemaster, TSF Academy Join Date: Jun 2006 Location: USA Posts: 7,463 OS: XP SP3	Re: Backdoor.Win32.Troffer.2, help required Hi, I see that you have posted at the HijackThis sub forum. Please make sure that you read this sticky and complete all the steps therein and post the required logs. If you are not able to do any of the steps, please move on to the next until you complete all 5 of them and report which step you were unable to complete. http://www.techsupportforum.com/secu...oval-help.html Also note that the HijackThis section of the forum is very busy and it may take a while before an analyst can reply to you. So, please be patient. Good luck. __________________ My services are free. However, you can donate to TSF to help keep it running. Member of ASAP since 2005 Member of UNITE since 2006