Win32:Iroffer-011 Found!

EXOX3 · Aug 15, 2006

Hi Guys,

I just installed Avast! Home Edition, becuase I kept getting a system locking problem, where it would work fine, then all of a sudden the system would pause, completely still for a few seconds, then return to the normal state, I can't even move the mouse cursor when it does this.

So anyway I installed Avast! and did a scan and it found a trojan horse, Win:Iroffer-011 to be specific, I moved it to the chest, but I dunno what to do from here, now the trojan was found via: C:\WINDOWS\System32\3049\ms-java\ms-java.exe, but also a few days ago when this problem started accuring, I checked my msconfig applet window for startup items, and their was 'Start.exe' @ C:\WINDOWS\System32\3049\ms-java\.....

I just haven't sat on my hands either, I`ve been googling for a while now and I cannot find specifics on this Trojan horse, I can find other ones, but not this one, any idea's on where to get more info on this Trojan, and maybe a inkling on how my PC came about getting it, like from certain software downloads maybe?

Also, since I have only removed the Startup string for starts.exe via RegSupreme, and moved the Trojan file via Avast! to the chest, is their anything more I should consider doing?

Sincearly,

David

PS: Also I dunno where MS Java came from, as I use Suns Java client for my torrent client Azu, which is only in the past 24 hours, MS-Java has been on this PC since 4 odd weeks ago, becuase on startup I always saw a command window quickly open, and quickly do something then flick off, but the only thing I could quickly attain was it said ms-java in it somewhere.....

http://forums.majorgeeks.com/attachment.php?attachmentid=40736&stc=1&d=1155630250

chaslang · Aug 15, 2006

If you are using MSconfig to control startups in any form, you must run MSconfig and then select Normal Startup before continuing on to the below.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

[*]runkeys.txt - the log from GetRunKey.bat
[*]newfiles.txt - the log from ShowNew.bat

CounterSpy - ONLY IF you were not able to run Windows Defender

Bitdefender - from step 6

Panda Scan - from step 6

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

Log in or Sign up

Win32:Iroffer-011 Found!

EXOX3 Staff Sergeant

Attached Files:

virus.JPG

chaslang MajorGeeks Admin - Master Malware Expert Staff Member