• Log InLog In
  • Register
Liquid`
Team Liquid Liquipedia
EDT 09:48
CEST 15:48
KST 22:48
  • Home
  • Forum
  • Calendar
  • Streams
  • Liquipedia
  • Features
  • Store
  • EPT
  • TL+
  • StarCraft 2
  • Brood War
  • Smash
  • Heroes
  • Counter-Strike
  • Overwatch
  • Liquibet
  • Fantasy StarCraft
  • TLPD
  • StarCraft 2
  • Brood War
  • Blogs
Forum Sidebar
Events/Features
News
Featured News
TL.net Map Contest #22 - Voting & Ladder Map Selection1Code S Season 2 (2026) - RO8 Preview4[ASL21] Finals Preview: Two Legacies21Code S Season 2 (2026) - RO12 Preview2herO wins GSL Code S Season 1 (2026)7
Community News
StarCraft II 5.0.16 PTR Patch Notes may 26th101Weekly Cups (May 18-25): MaxPax wins doubles0Crank Gathers Season 4: BW vs SC2 Team League4Weekly Cups (May 11-17): Classic wins double1Code S Season 1 (2026) - RO8 Results2
StarCraft 2
General
The death of cheese, from a professional cheeser. Changing from 12 to 8 is just asking for StarCraft StarCraft II 5.0.16 PTR Patch Notes may 26th TL Poll: How do you feel about the 5.0.16 PTR balance changes? Weekly Cups (May 11-17): Classic wins double
Tourneys
RSL Revival: Season 5 - Qualifiers and Main Event GSL Code S Season 2 (2026) Sparkling Tuna Cup - Weekly Open Tournament Crank Gathers Season 4: BW vs SC2 Team League GSL Code S Season 1 (2026)
Strategy
[G] Having the right mentality to improve
Custom Maps
[D]RTS in all its shapes and glory <3 [A] Nemrods 1/4 players
External Content
Welcome to the External Content forum Mutation # 527 Hell Train The PondCast: SC2 News & Results Mutation # 526 Rubber and Glue
Brood War
General
BGH Auto Balance -> http://bghmmr.eu/ Soma's ASL Finals Review FlaShFTW vs A.Alm Grudge Match Event OGN to release AI-upscaled StarLeague from Feb 24 BW General Discussion
Tourneys
[ASL21] Grand Finals [Megathread] Daily Proleagues Escore Tournament StarCraft Season 2 [BSL22] WB Final & LB Semis - Saturday 21:00 CEST
Strategy
Any training maps people recommend? Muta micro map competition [G] Hydra ZvZ: An Introduction Fighting Spirit mining rates
Other Games
General Games
Stormgate/Frost Giant Megathread Nintendo Switch Thread ZeroSpace Megathread Path of Exile Dawn of War IV
Dota 2
Official 'what is Dota anymore' discussion
League of Legends
Heroes of the Storm
Simple Questions, Simple Answers Heroes of the Storm 2.0
Hearthstone
Deck construction bug Heroes of StarCraft mini-set
TL Mafia
Vanilla Mini Mafia Mafia Game Mode Feedback/Ideas TL Mafia Community Thread Five o'clock TL Mafia
Community
General
Russo-Ukrainian War Thread US Politics Mega-thread Things Aren’t Peaceful in Palestine Trading/Investing Thread Dating: How's your luck?
Fan Clubs
The herO Fan Club!
Media & Entertainment
[Manga] One Piece Anime Discussion Thread [Req][Books] Good Fantasy/SciFi books
Sports
2024 - 2026 Football Thread McBoner: A hockey love story TeamLiquid Health and Fitness Initiative For 2023 Formula 1 Discussion
World Cup 2022
Tech Support
Computer Build, Upgrade & Buying Resource Thread Facing Challenges in Mobile App Development
TL Community
The Automated Ban List
Blogs
Esportsmanship: How to NOT B…
TrAiDoS
Why RTS gamers make better f…
gosubay
ramps on octagon
StaticNine
ASL S21 English Commentary…
namkraft
Customize Sidebar...

Website Feedback

Closed Threads



Active: 1844 users

[H]Huge BackDoor Trojan Problem

Blogs > Mickey
Post a Reply
1 2 Next All
Mickey
Profile Blog Joined July 2005
United States2606 Posts
Last Edited: 2009-06-18 05:20:59
June 18 2009 05:14 GMT
#1
I never thought I'd say this, but I seriously need help getting rid of the nastiest malware infection I've ever had.

This infection not only slows down my computer, crashes firefox, redirects search results, it also doesn't let certain antispyware programs install/turn on.

+ Show Spoiler +
[image loading]


I tried researching how to get rid of it ,and I just found this link.
LINK

I've tried booting up in Safe Mode and using both Antivir/Super Antispyware it found about 50 Trojans. Antivir finds that specific Trojan, but won't let me remove it. A squared found it, but won't let me remove it.

Malwarebytes/Spybot install, but won't run. I tried changing the .exe file like I did with super Antispyware, but it still won't run.

Does anyone know anything that will FUCKING kill this? If worst comes to worst I'll have to reformat.

GOD THIS IS THE SMARTEST VIRUS EVER!

RaGe
Profile Blog Joined July 2004
Belgium9950 Posts
June 18 2009 05:20 GMT
#2
You couldn't run Malwarebytes in Safe Mode? I find that hard to believe.
Moderatorsometimes I get intimidated by the size of my right testicle
jimminy_kriket
Profile Blog Joined February 2007
Canada5533 Posts
June 18 2009 05:22 GMT
#3
Does hijack this run? Try posting a hijackthis log on a tech forum
life of lively to live to life of full life thx to shield battery
Mickey
Profile Blog Joined July 2005
United States2606 Posts
Last Edited: 2009-06-18 05:27:37
June 18 2009 05:23 GMT
#4
On June 18 2009 14:20 RaGe wrote:
You couldn't run Malwarebytes in Safe Mode? I find that hard to believe.

It won't run. It takes forever to install(probably the virus/trojan is doing it's mischief).
On June 18 2009 14:22 jimminy_kriket wrote:
Does hijack this run? Try posting a hijackthis log on a tech forum

First, thing I did was run hijackthis, and post it on a site that analyzes malicious processes. The problem is that Hijackthis can't detect these. All the ones it did detect I deleted.

My LOG(WARNING LONG)
+ Show Spoiler +

Logfile of HijackThis v1.99.1
Scan saved at 12:23:38 AM, on 6/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Mike\My Documents\asddadw.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Shrimp\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
O15 - Trusted Zone: http://*.att.net
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SP\SASWINLO.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Google Update Service (gupdate1c912faf57de5c4) (gupdate1c912faf57de5c4) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe


I'm currently using the online scanner Housecall.
Kentor *
Profile Blog Joined December 2007
United States5784 Posts
June 18 2009 05:28 GMT
#5
Dude just reformat.
Mickey
Profile Blog Joined July 2005
United States2606 Posts
Last Edited: 2009-06-18 05:31:44
June 18 2009 05:31 GMT
#6
On June 18 2009 14:28 Kentor wrote:
Dude just reformat.

No. I'm fucking sick of people always just saying "Reformat!". Do you know how much a pain in the ass it is, also I've always been a pretty knowledgeable person on ad ware/viruses. My Brother has fucked up the comp tons of tons of times doing dumb shit/looking at porn. I've always fixed the infection. Reformatting is like excepting defeat in my opinion.

God why do I always have stress/shit happened to me. I'm a nice guy!
ZoW
Profile Blog Joined January 2009
United States3983 Posts
June 18 2009 05:32 GMT
#7
Have you tried combofix?
the courage to be a lazy bum
Bac
Profile Joined January 2009
United States53 Posts
June 18 2009 05:32 GMT
#8
Anyone else do a double-take after reading the thread title, and then after clicking on the thread feel ashamed and dirty for your thoughts?
evanthebouncy!
Profile Blog Joined June 2006
United States12796 Posts
June 18 2009 05:34 GMT
#9
I was gonna say why you need to wear condoms while fucking in the anus.
Life is run, it is dance, it is fast, passionate and BAM!, you dance and sing and booze while you can for now is the time and time is mine. Smile and laugh when still can for now is the time and soon you die!
Reason
Profile Blog Joined June 2006
United Kingdom2770 Posts
June 18 2009 05:35 GMT
#10
Nasty processes you got there :o
Speak properly, and in as few words as you can, but always plainly; for the end of speech is not ostentation, but to be understood.
Kentor *
Profile Blog Joined December 2007
United States5784 Posts
Last Edited: 2009-06-18 05:36:38
June 18 2009 05:35 GMT
#11
On June 18 2009 14:31 Mickey wrote:
Show nested quote +
On June 18 2009 14:28 Kentor wrote:
Dude just reformat.

No. I'm fucking sick of people always just saying "Reformat!". Do you know how much a pain in the ass it is, also I've always been a pretty knowledgeable person on ad ware/viruses. My Brother has fucked up the comp tons of tons of times doing dumb shit/looking at porn. I've always fixed the infection. Reformatting is like excepting defeat in my opinion.

God why do I always have stress/shit happened to me. I'm a nice guy!

Well next time put all your shit in another partition different from the OS. You only need at most about 60GB for your OS.
Deleted User 3420
Profile Blog Joined May 2003
24492 Posts
Last Edited: 2009-06-18 05:41:18
June 18 2009 05:38 GMT
#12
Try downloading "trojan defense suite"

u can get a trial of the newest version for free, probably

here

http://tucows.menanet.net/preview/195501.html
jimminy_kriket
Profile Blog Joined February 2007
Canada5533 Posts
June 18 2009 05:40 GMT
#13
Well only advice i can give really is to wait for people on the tech forum you posted at to give you further instructions and in the meantime try running every online scanner known to man. F secure, eset, panda, bitdefender all have good scanners if i recall correctly
life of lively to live to life of full life thx to shield battery
Grobyc
Profile Blog Joined June 2008
Canada18410 Posts
June 18 2009 05:53 GMT
#14
Stop downloading so much porn?

and this:
On June 18 2009 14:34 evanthebouncy! wrote:
I was gonna say why you need to wear condoms while fucking in the anus.

kekeke
If you watch Godzilla backwards it's about a benevolent lizard who helps rebuild a city and then moonwalks into the ocean.
Mickey
Profile Blog Joined July 2005
United States2606 Posts
Last Edited: 2009-06-18 06:00:30
June 18 2009 05:56 GMT
#15
On June 18 2009 14:32 ZoW wrote:
Have you tried combofix?

I'm not really knowledgeable on this software. I've read it in the threads, but I also found out that it can do some damage to your OS if not used properly.

Would you care to explain how it works?
On June 18 2009 14:38 travis wrote:
Try downloading "trojan defense suite"

u can get a trial of the newest version for free, probably

here

http://tucows.menanet.net/preview/195501.html

Thanks will do although this seems really old.
On June 18 2009 14:53 Grobyc wrote:
Stop downloading so much porn?

I don't download porn I'm smarter than that. I stream it on Redtube with adblocker making that window look clean.

Honestly another thing that is bothering me is how I got the trojan to begin with. I have to 2 possibilities. A MP3 I downloaded, or a Antivirus suit torrent I downloaded and ran. I think it was the MP3.

I knew it looked shady. Chains of Love by Erasure is now my least favorite song ever.
Deleted User 3420
Profile Blog Joined May 2003
24492 Posts
June 18 2009 06:00 GMT
#16
It is old, but the trojan/virus lists are up to date afaik

pretty sure it's the best there is
Mickey
Profile Blog Joined July 2005
United States2606 Posts
June 18 2009 06:02 GMT
#17
Travis you are my boy. I owe you man.
Deleted User 3420
Profile Blog Joined May 2003
24492 Posts
June 18 2009 06:07 GMT
#18
did you get it fixed?
glad I could help
MamiyaOtaru
Profile Blog Joined September 2008
United States1687 Posts
Last Edited: 2009-06-18 07:09:40
June 18 2009 07:07 GMT
#19
On June 18 2009 14:56 Mickey wrote:
Honestly another thing that is bothering me is how I got the trojan to begin with. I have to 2 possibilities. A MP3 I downloaded, or a Antivirus suit torrent I downloaded and ran. I think it was the MP3.

Hahaha are you serious? Your choices are a music file and a warezed app suite containing presumably at least one executable, and you suspect the music file??

Admit defeat. Reformat. Once you've been back doored you can never be sure it is gone. That's the nature of rootkits. And next time don't download warez antivirus apps. Wasn't your brother "doing dumb shit" this time.

I mean, it's cool if it seems like Trojan Defense Suite worked, but all the programs you tried previously either couldn't detect or remove something. You can't be %100 sure that TDS got everything, that there isn't something there it couldn't find. I mean if there are no symptoms continue merrily on your way or whatever. Hope you're not part of a botnet.
Etherone
Profile Blog Joined November 2008
United States1898 Posts
June 18 2009 07:34 GMT
#20
TL > tech forums

well for further reference i would love to know how you got rid of it.
1 2 Next All
Please log in or register to reply.
Live Events Refresh
OSC
13:00
King of the Hill #250
iHatsuTV 18
Liquipedia
Maestros of the Game
13:00
Preliminary Stage
SHIN vs NicoractLIVE!
Rogue vs Gerald
ByuN vs Shameless
Cure vs TriGGeR
RotterdaM952
ComeBackTV 744
TaKeTV370
IndyStarCraft 131
SteadfastSC127
Rex117
LiquipediaDiscussion
[ Submit Event ]
Live Streams
Refresh
StarCraft 2
RotterdaM 952
LamboSC2 300
IndyStarCraft 131
SteadfastSC 127
Rex 117
ProTech80
Railgan 38
Codebar 8
StarCraft: Brood War
firebathero 10084
Horang2 1206
EffOrt 849
ZerO 491
Rush 198
Last 187
Pusan 177
hero 158
ToSsGirL 147
JulyZerg 69
[ Show more ]
sorry 42
Sacsri 40
Movie 28
Nal_rA 26
Barracks 25
GoRush 21
IntoTheRainbow 18
ajuk12(nOOB) 16
Noble 14
Terrorterran 12
Icarus 8
Rock 1
Dota 2
Dendi2223
qojqva2106
XcaliburYe330
LuMiX1
Heroes of the Storm
Khaldor214
Liquid`Hasu193
MindelVK18
Other Games
B2W.Neo1493
Liquid`RaSZi1399
mouzStarbuck106
Mew2King51
singsing39
ZerO(Twitch)20
XlorD15
NotJumperer13
Organizations
Counter-Strike
PGL244
StarCraft: Brood War
lovetv 34
StarCraft 2
Blizzard YouTube
StarCraft: Brood War
BSLTrovo
[ Show 15 non-featured ]
StarCraft 2
• StrangeGG 88
• HeavenSC 16
• AfreecaTV YouTube
• intothetv
• Kozan
• IndyKCrew
• LaughNgamezSOOP
• Migwel
• sooper7s
StarCraft: Brood War
• BSLYoutube
• STPLYoutube
• ZZZeroYoutube
League of Legends
• Nemesis4171
• Jankos1789
• Stunt599
Upcoming Events
IPSL
2h 13m
Dragon vs Artosis
dxtr13 vs Hawk
Showmatch
2h 13m
Percival vs Lambo
ByuN vs Clem
YoungYakov vs GuMiho
ByuN vs Creator
BSL
5h 13m
OSC
10h 13m
Wardi Open
22h 13m
Monday Night Weeklies
1d 2h
Replay Cast
1d 10h
Sparkling Tuna Cup
1d 20h
WardiTV Spring Champion…
1d 21h
Maestros of the Game
2 days
[ Show More ]
The PondCast
2 days
Kung Fu Cup
2 days
uThermal 2v2 Circuit
3 days
Maestros of the Game
3 days
Replay Cast
3 days
Replay Cast
3 days
WardiTV Spring Champion…
3 days
Maestros of the Game
4 days
Replay Cast
4 days
uThermal 2v2 Circuit
5 days
Maestros of the Game
5 days
Replay Cast
5 days
Solar vs Classic
uThermal 2v2 Circuit
6 days
GSL
6 days
Liquipedia Results

Completed

Escore Tournament S2: King of Kings
2026 GSL S1
Heroes Pulsing #1

Ongoing

2026 KK StarCraft Pro League
BSL Season 22
IPSL Spring 2026
KCM Race Survival 2026 Season 2
KK 2v2 League Season 1
Acropolis #4
CSCL: Masked Kings S4
YSL S3
SCTL 2026 Spring
WardiTV Spring 2026
Maestros of the Game 2
2026 GSL S2
Murky Cup 2026
Stake Ranked Episode 2
CS Asia Championships 2026
Asian Champions League 2026
IEM Atlanta 2026
PGL Astana 2026
BLAST Rivals Spring 2026
IEM Rio 2026
PGL Bucharest 2026
Stake Ranked Episode 1
BLAST Open Spring 2026

Upcoming

BSL 22 Non-Korean Championship
CSLAN 4
Blizzard Classic Cup 2026
Kung Fu Cup 2026 Grand Finals
CranK Gathers Season 4: BW vs SC2 Team League
HSC XXIX
uThermal 2v2 2026 Main Event
Heroes Pulsing #3
Heroes Pulsing #2
Esports World Cup 2026
BLAST Bounty Summer 2026
BLAST Bounty Summer Qual
Stake Ranked Episode 3
XSE Pro League 2026
IEM Cologne Major 2026
TLPD

1. ByuN
2. TY
3. Dark
4. Solar
5. Stats
6. Nerchio
7. sOs
8. soO
9. INnoVation
10. Elazer
1. Rain
2. Flash
3. EffOrt
4. Last
5. Bisu
6. Soulkey
7. Mini
8. Sharp
Sidebar Settings...

Advertising | Privacy Policy | Terms Of Use | Contact Us

Original banner artwork: Jim Warren
The contents of this webpage are copyright © 2026 TLnet. All Rights Reserved.