[jb12]

Hello, I'm new here and not an expert with computers and such so please bear with me.

I just recently did a virus scan with kaspersky and found a trojan, and got rid of it. Well, ever since I did that I'm getting these popups that say this exactly:

Access violation at address 0049DBF4 in module 'ping.exe'. Read of address 07190278

It's happened to me when I open up CCleaner and click on the update button. It also happened when I went into control panel and clicked on windows update. Earlier tonight my girlfriend was on the computer and left it on for a while, and it popped up. I asked her what she was doing, and she said she just left it on and did nothing.

I go and look at the report in Kaspersky and these are the files it deleted, or disinfected.. or whatever it is that it does to them..

Infected: Trojan program Trojan-Spy.Win32.Banker.gsh
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\rp111\a0028195.dll 185.5 KB

Infected: Trojan program Trojan-Proxy.Win32.Delf.dp
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\rp106\a0027703.exe 193.5 KB

Infected: Trojan program Trojan-Spy.Win32.Banker.gnx
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\rp111\a0028196.exe 98.5 KB

Infected: Trojan program Trojan-Proxy.Win32.Delf.dp
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\rp113\a0028371.exe 193.5 KB

Infected: Trojan program Trojan-Spy.Win32.Banker.gsi
c:\system volume information\_restore{b37680b2-ba0a-4e5d-bf30-83e44c588624}\rp111\a0028194.exe 300.5 KB

Infected: Trojan program Trojan-Proxy.Win32.Delf.dp
c:\documents and settings\armando\local settings\temp\temporary directory 2 for qwioeu263[1].zip\qwioeu263.exe 198.5 KB


My computer has been running completely fine, and nothing out of the ordinary is going on except for this. Whenever this popup comes on, I can't click the red X and close it so I go into task manager and close a DrWatson program there, and it closes the popup. And everything is back to normal after that. Even if I try and get that popup to show up with the CCleaner update, or Windows update after all this it wont pop up anymore.

I've tried my best to fully explain everything, but will provide any other info if needed. If anyone out there can help I'd appreciate it very much. Thanks.

Edited by jb12, 25 December 2007 - 11:35 PM.

[Advertisements]

Hello jb12 and welcome to Geeks to Go!

I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post a HiJackThis Log in THAT forum. If you are unable to run and/or post a HJT log, then post that in your initial post in the topic you create in that forum.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

Regards,

Ax

[Ax238]

Hello jb12 and welcome to Geeks to Go!

I suggest you go to the Malware Forum and run all the steps located in the START HERE. These self-help tools will help you clean up 70% of problems on your own. If you are still having problems after doing the steps, then please post a HiJackThis Log in THAT forum. If you are unable to run and/or post a HJT log, then post that in your initial post in the topic you create in that forum.

If you are still having problems after being given a clean bill of health from the malware expert, then please return to THIS thread and we will pursue other options to help you solve your current problem(s).

Regards,

Ax

[jb12]

Thanks. Just wanted to let you know that my problem was completely resolved.

[The Skeptic]

Could you share the solution with us? We are here to learn as much as to help.

Thanks

The Skeptic

[jb12]

To be honest, I have no idea what I was doing. I was lucky enough to get help from Essexboy who was awesome. He made it seem like it was so simple.. which I'm sure it wasn't. Anyway, here's the link to the thread..



http://www.geekstogo...xe-t181175.html

[Ax238]

I'm glad to hear that your problem has been resolved. It is like our malware removal experts to make things appear easy, but you're right, much research goes into determining how to handle infections. You can feel confident in the knowledge that your log was looked at under the most scrutinizing of eyes.

Regards,

Ax