goldun.exe?????

ninjahound · 04-20-2006, 09:25 AM

Hello. I am a member of an online "bank" (so to speak) called E-Gold. I was recently told that there is a bug called "goldun.exe" that will apparently wait for E-Gold users to try to log in, then it will enter your computer, (As a virus maybe?), and I was told that this "bug" was very bad. Assuming it is a bug and not the name of an E-Gold related program, assuming the people that warned me knew what they were talking about, what should I do???

tribalgypsy · 04-20-2006, 11:02 AM

I received a second pin entry after trying to log in...after reading message in DadnDave's autosurf I immediately closed the window and joined here to find out what to do. I received an email from the PINrobot....saying I needed to put in a new pin if I am logging in from a different address which I am. Im out of town for 3 weeks and using my computer at my friend's home with different ISP address. So I'm thinking the PIN robot is real but not sure if I should do anything until I find out if it's the goldun whatever....advice?? Thanks

Dave22 · 04-20-2006, 01:12 PM

To Tribalgypsy: I too deal with E-Gold. Every time I have changed location/computers the "PinRobot" comes up. I have entered the pin with no problems. It is a normal security feature.

to ninjahound: Regarding the "goldun" virus. I too have the problem. It is a pesky little guy. I have tried different ways to get rid of it without success.
I use Nortons, which can't fix it. I am also hoping that these good folks here can help us not only clear this bug out but block it if possible, from re-entering. In the meantime maybe we should stay away from E-Gold until this is resolved...then go back to E-Gold and change our pw, etc.

Adrianne · 04-20-2006, 01:16 PM

I also was hit with this file. A day late and $11.00 short. That's all they got away with. What I did was go to another comuter in our home, and log in to egold, changed all my settings, AGAIN including the ip address.

About 10 minutes later, the hacker was trying to access my account, but couldn't because he/she was at a different ip address. The egold Robot sent me an email with the hacker's ip addy. I forwarded it to egold and asked them to delete this users account because he/she is stealing from people.

I did a complete scan with Norton, and I did a search for the goldun.exe file and it did not come up.

Does this mean it is no longer on my machine?

I no longer log into any of my payment account from this computer. I only use our other computer for that.

Many blessings,
Adrianne

job5287 · 04-20-2006, 06:02 PM

HI,
I have on my computer the Trojan Goldun virus.The Norton Antivirus detect it but it unable to quarantine or delete it because access to the file was denied.
I click on the virus link to redirect to the Norton antivirus website and followed their instruction how to remove the virus by full scan and tried to delete the file from the regedit ,unfortunately I couldn't find the "Navigate to the key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:

"Shell" = "%Windir%\wmedia16.exe" "
on my regidit and the alarm still showing that I have the virus on my computer.
Please if their is anyone to help me to get rid from this virus.
Thanks,
Jacob

**K-B** · 04-20-2006, 06:38 PM

Try running your scans in Safe Mode...press F8 during while booting to enter Safe Mode.

Run the 5-Step process outlined Here

Hope it helps.

MicroBell · 04-20-2006, 07:17 PM

For those infected with the trojan...please run through the 5 step process here...http://www.techsupportforum.com/hija...ijackthis.html and post your log in the hijackthis forum and we will address it.

Quote:

Troj/Goldun-U usually arrives disguised as a service pack for the E-Gold
application. This can sometimes be in the form of a fake setup program which
drops the file voweh.exe into the users Temp folder and run it. Once executed this file will drop a file named mslown.dll in the Windows system folder.

The dropped DLL is a Browser Help Object which intercepts internet requests destined for the E-Gold site and steals account information, forwarding it to a remote site.

tribalgypsy · 04-21-2006, 09:20 AM

Hi Dave22: Thanks so much for the quick reply. I sort of figured that it might be real as I am in another location....just concerned that it may have been the dreaded goldun.exe.....thanks again....

chastech · 04-21-2006, 04:19 PM

I had my e-gold account emptied (luckily only $4) and
I found gdiwxp.dll on my computer.

Of all the tools I tried, only "Security Task Manager" (free) detected this e-gold password stealing trojan.
Look for this nasty dll in C:\Windows\System32.

The following programs did NOT detect it:
Trend Internet Security 2006
Spy Doctor
Ad-Aware
Webroot Spy Sweeper
Windows Defender (Microsoft)

If you get a message from your antivirus/firewall program saying
"WINLOGON.EXE" is trying to access the internet, DONT ALLOW IT!
Also look for a program called "w" (C:\w) on your hard drive.
Deleting this won't help as it will re-appear again. Security Task Manager will remove it.

Hope this helps

04-20-2006, 09:25 AM	#1 (permalink)
ninjahound Registered User Join Date: Apr 2006 Posts: 1 OS: Win XP	goldun.exe????? Hello. I am a member of an online "bank" (so to speak) called E-Gold. I was recently told that there is a bug called "goldun.exe" that will apparently wait for E-Gold users to try to log in, then it will enter your computer, (As a virus maybe?), and I was told that this "bug" was very bad. Assuming it is a bug and not the name of an E-Gold related program, assuming the people that warned me knew what they were talking about, what should I do???

04-20-2006, 11:02 AM	#2 (permalink)
tribalgypsy Registered User Join Date: Apr 2006 Posts: 2 OS: windows 2000	e-gold pin....goldun.exe? I received a second pin entry after trying to log in...after reading message in DadnDave's autosurf I immediately closed the window and joined here to find out what to do. I received an email from the PINrobot....saying I needed to put in a new pin if I am logging in from a different address which I am. Im out of town for 3 weeks and using my computer at my friend's home with different ISP address. So I'm thinking the PIN robot is real but not sure if I should do anything until I find out if it's the goldun whatever....advice?? Thanks

04-20-2006, 01:12 PM	#3 (permalink)
Dave22 Registered User Join Date: Apr 2006 Posts: 1 OS: winXP	goldun To Tribalgypsy: I too deal with E-Gold. Every time I have changed location/computers the "PinRobot" comes up. I have entered the pin with no problems. It is a normal security feature. to ninjahound: Regarding the "goldun" virus. I too have the problem. It is a pesky little guy. I have tried different ways to get rid of it without success. I use Nortons, which can't fix it. I am also hoping that these good folks here can help us not only clear this bug out but block it if possible, from re-entering. In the meantime maybe we should stay away from E-Gold until this is resolved...then go back to E-Gold and change our pw, etc. Last edited by Dave22; 04-20-2006 at 01:16 PM.

04-20-2006, 01:16 PM	#4 (permalink)
Adrianne Registered User Join Date: Apr 2006 Posts: 16 OS: XP Professional	Goldun.exe Got to Me Too I also was hit with this file. A day late and $11.00 short. That's all they got away with. What I did was go to another comuter in our home, and log in to egold, changed all my settings, AGAIN including the ip address. About 10 minutes later, the hacker was trying to access my account, but couldn't because he/she was at a different ip address. The egold Robot sent me an email with the hacker's ip addy. I forwarded it to egold and asked them to delete this users account because he/she is stealing from people. I did a complete scan with Norton, and I did a search for the goldun.exe file and it did not come up. Does this mean it is no longer on my machine? I no longer log into any of my payment account from this computer. I only use our other computer for that. Many blessings, Adrianne

04-21-2006, 09:20 AM	#8 (permalink)
tribalgypsy Registered User Join Date: Apr 2006 Posts: 2 OS: windows 2000	Pin Robot Hi Dave22: Thanks so much for the quick reply. I sort of figured that it might be real as I am in another location....just concerned that it may have been the dreaded goldun.exe.....thanks again....

04-20-2006, 06:02 PM	#5 (permalink)
job5287 Registered User Join Date: Apr 2006 Posts: 1 OS: winxp	HI, I have on my computer the Trojan Goldun virus.The Norton Antivirus detect it but it unable to quarantine or delete it because access to the file was denied. I click on the virus link to redirect to the Norton antivirus website and followed their instruction how to remove the virus by full scan and tried to delete the file from the regedit ,unfortunately I couldn't find the "Navigate to the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run In the right pane, delete the value: "Shell" = "%Windir%\wmedia16.exe" " on my regidit and the alarm still showing that I have the virus on my computer. Please if their is anyone to help me to get rid from this virus. Thanks, Jacob

04-20-2006, 06:38 PM	#6 (permalink)
K-B Mod. Linux, Wrench Turner Join Date: Oct 2005 Location: NY Posts: 2,889 OS: Vista, Ubuntu My System	Try running your scans in Safe Mode...press F8 during while booting to enter Safe Mode. Run the 5-Step process outlined Here Hope it helps.

04-21-2006, 04:19 PM	#9 (permalink)
chastech Registered User Join Date: Apr 2006 Posts: 1 OS: xp	I had my e-gold account emptied (luckily only $4) and I found gdiwxp.dll on my computer. Of all the tools I tried, only "Security Task Manager" (free) detected this e-gold password stealing trojan. Look for this nasty dll in C:\Windows\System32. The following programs did NOT detect it: Trend Internet Security 2006 Spy Doctor Ad-Aware Webroot Spy Sweeper Windows Defender (Microsoft) If you get a message from your antivirus/firewall program saying "WINLOGON.EXE" is trying to access the internet, DONT ALLOW IT! Also look for a program called "w" (C:\w) on your hard drive. Deleting this won't help as it will re-appear again. Security Task Manager will remove it. Hope this helps