Welcome Guest ( Log In | Register )

Outline · [ Standard ] · Linear+

 trojan psw.onlinegames (help), Infected from xunlei, thunder5?

views
     
penguin_ex
post Oct 17 2007, 09:47 AM

Getting Started
**
Junior Member
189 posts

Joined: Oct 2004
From: Just NEXT to you



QUOTE(lamely_named @ Oct 17 2007, 09:36 AM)
I'm not sure if it's xunlei (thunder5) or not.

but AVG has detected this psw.onlinegame trojan everytime the xunlei pop up ads comes up.

You know when you left xunlei to run on its own over night and it pops up some ads? Thats when AVG detected the trojan.

the trojan also drops various .exe and .dll file with random names into my system folder, Temporary internet file folder and temp folder.

whenever I clean them all with AVG in safe mode, it'll disable my internet connection, something about the trojan corrupted my winsocks even after it's deleted.

so I had to use winsocks fix to fix it. (not a big problem)

but after I've clean my system for a few days, AVG detected the trojan again, everytime when I'm running xunlei overnight, and it pops up some ads sponsored by xunlei.

so am I getting "re-infected" by xunlei after I removed the trojan or is the trojan hidden somehow and takes a few days to re-infect my system?

I really dont want to remove xunlei, it's the only bittorrent client that can bypass streamyx throttling.
*
R u using MS Internet Explorer?
If so, please stop using it, the IE will trigger the xunlei event every time u start using it.
Yet Please do turn off system restore before you start scanning and cleaning the drive.
Do use Spy bot S&D resident shield to protect your registry from being changed.
Do NOT ever or never to click on any ads popup by xunlei, i being infected before due to itchy hand and click on the ads, the virus spread so fast i have to uninstall the xunlei in safe mode and do all the cleaning in save mode. re-install back the xunlei to continue to use it.

Do correct me if i'm wrong.
penguin_ex
post Oct 17 2007, 10:01 AM

Getting Started
**
Junior Member
189 posts

Joined: Oct 2004
From: Just NEXT to you



QUOTE(lamely_named @ Oct 17 2007, 09:57 AM)
so I have to uninstall IE 6?

and the pop up ads will die?

I never click on the ads. It just pops up overnight after I left xunlei running.

I saw the AVG virus warning in the morning, together with the pop up ads.

so after you did what you said, it did not re-infect your system or pop up any xunlei ads anymore?
*
No need to uninstall IE, juz dun use it, cauze xunlei hav some plugin in IE that will cause chaos, start using other explorer such as FireFox or Opera, unless u disable all the plugin and ActiveX control wich is the most headache part of IE.

» Click to show Spoiler - click again to hide... «


-----------Added----------
You can get some info from here

This post has been edited by penguin_ex: Oct 17 2007, 10:05 AM
penguin_ex
post Oct 18 2007, 10:51 AM

Getting Started
**
Junior Member
189 posts

Joined: Oct 2004
From: Just NEXT to you



QUOTE(lamely_named @ Oct 17 2007, 01:23 PM)
I have a feeling it's not xunlei's fault.

but I am running out of idea as to where I got this trojan from.

How to completely remove it?

where is it hiding?

google turns up with little to no info of this.

btw, there's an IEXPLORE.EXE running as a "system" process in my task manager, right after I start up my computer, I have not opened any IE windows.

This happened right after I got the AVG warning, not before.

is this one of the trojan or something else?
*
QUOTE(eXPeri3nc3 @ Oct 18 2007, 10:43 AM)
Perhaps the one that's triggering AVG was 'something' in your IE not xunlei.
*
I've mentioned in previous post that the event is trigger by IE where it start when you startup the IE ni the post below>>

QUOTE(penguin_ex @ Oct 17 2007, 10:01 AM)
No need to uninstall IE, juz dun use it, cauze xunlei hav some plugin in IE that will cause chaos, start using other explorer such as FireFox or Opera, unless u disable all the plugin and ActiveX control wich is the most headache part of IE.

» Click to show Spoiler - click again to hide... «


-----------Added----------
You can get some info from here
*
and eXPeri3nc3 hav the link to the information on post #9 and the link to the psw.trojan information in symantec has been put in my previous post also ^


 

Change to:
| Lo-Fi Version
0.0148sec    0.51    6 queries    GZIP Disabled
Time is now: 12th December 2025 - 02:18 AM