a mystery regarding a trojan.

voyagerbear · 06-21-2009, 01:41 PM

Now , I will try to make this as clear as possible. I started using this site asking about a pop up message that continually appears when I open video footage downloaded from a sony handycam to my Vaio laptop stating that Windows Host process [Rundll32] has stopped working. It does not however stop the video from playing. Also when I listen to live radio, the player appears but there is no sound. Contacted Sony and it is out of their scope. Then I ran a full system scan using Norton and it found a tracking cookie which it dealt with and a Hack Tool (in red). I then clicked on details and this was the result:

[keygen.exe]inside of[c.\users\rosie\appdat\virtualstore\programfiles\nbprp\download\alt.binaries.warez\adobe.photoshop.CS4.extended.V.11.O.incl.keymaker-core.var.001] I think that is correct.

However, The Windows Defender scan shows nothing and the SpyBot found some other adware which it dealt with but not the keygen. The last SpyBot scan showed no problems. I can't understand why it is showing on Norton and they cannot remove it. Please please help. Thanks.

**TheBruce1** · 06-21-2009, 03:51 PM

Hello

Quote:

[keygen.exe]inside of[c.\users\rosie\appdat\virtualstore\programfiles\nbprp\download\alt.binaries.warez\adobe.photoshop.CS4.extended.V.11.O.incl.keymaker-core.var.001] I think that is correct.

Quote:

This is the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is always a risk.

Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore.

If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer.

Additionally, cracked programs are illegal. Before posting for help, uninstall any such applications.

Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine

Once you have removed all crack programs/applications follow instructions set out below.

========

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a

Quote:

Having problems with spyware and pop-ups? First Steps

link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

06-21-2009, 01:41 PM	#1 (permalink)
voyagerbear Registered User Join Date: Jun 2009 Posts: 12 OS: vista service pack 1 build 6001	a mystery regarding a trojan. Now , I will try to make this as clear as possible. I started using this site asking about a pop up message that continually appears when I open video footage downloaded from a sony handycam to my Vaio laptop stating that Windows Host process [Rundll32] has stopped working. It does not however stop the video from playing. Also when I listen to live radio, the player appears but there is no sound. Contacted Sony and it is out of their scope. Then I ran a full system scan using Norton and it found a tracking cookie which it dealt with and a Hack Tool (in red). I then clicked on details and this was the result: [keygen.exe]inside of[c.\users\rosie\appdat\virtualstore\programfiles\nbprp\download\alt.binaries.warez\adobe.photoshop.CS4.extended.V.11.O.incl.keymaker-core.var.001] I think that is correct. However, The Windows Defender scan shows nothing and the SpyBot found some other adware which it dealt with but not the keygen. The last SpyBot scan showed no problems. I can't understand why it is showing on Norton and they cannot remove it. Please please help. Thanks.