really need virus help badly

Discussion in 'Anti-Virus' started by PoetStorm, Jan 12, 2004.

  1. PoetStorm

    PoetStorm Guest

    Hi, I hope I have found the right place as I really need some info. My
    husbands computer has some sort of virus / malware on it that McAfee Prof
    Edition 7 and 2 online scanners including housecall could not find. I even
    ran a bunch of spyware and adware removers - nothing. We've run AV programs
    in safe mode too and over a network from another computer - nothing there
    either. I've been working on this for weeks and it looks like this will be
    my last ditch effort before a reinstall which really bums.
    It cerates a program called IIC***.exe. The *** appears to be a random hex
    number that changes each time. This process tries to go out to the internet
    usually around 10 or 11PM and Zone Alarm notifies us. The thing is if you
    find and delete this file, or just say no on Zone Alarm, another with a
    different random number comes up. Earlier on we were also having problems
    with random processes and registry entries coming up but that mysteriously
    stopped. Also, I looked at the .exe file in notepad for kicks and it said
    something about a spyware program called goblinicon. I checked and there are
    directions for removing this goblinicon thing but the files they tell you to
    remove are not on my computer and there are some differences in behavior.
    Maybe it is a mutated version but I am really uncomfortable with this. It
    did actually get out onto the internet once as ZoneAlarm had crashed for a
    different reason. Can anyone help?

    --

    Laura
    ICQ 174756639
    AIM poetstrm425
    www.lioddities.com
     
    PoetStorm, Jan 12, 2004
    #1
    1. Advertisements

  2. It would be helpfull, if you included which removers you've tried.

    If it's a virus that's infected an executable, that's normally being started,
    and none of the scanners can id it yet, a reinstall might be best.

    Assuming that it's a trojan, that is being started automatically, the key
    is to find out where it's being started.
    http://users.iafrica.com/c/cq/cquirke/startup.htm describes most of how
    programs get started. It's windows 95/98 oriented, but most of it still
    applies to xp. Also, check the task scheduler.

    Another option, to help find where it's starting, is hijackthis.
    Follow the intructions at http://tomcoyote.org/hjt/ to get and use it.

    Regards, Dave Hodgins
     
    David W. Hodgins, Jan 12, 2004
    #2
    1. Advertisements

  3. PoetStorm

    taff Guest

    This is related to adgoblin. The information is here.
    http://forums.spywareinfo.com/index.php?showtopic=18919

    Taff..............



    www.sounds-pa.com | www.thecomputerworkshop.com
     
    taff, Jan 12, 2004
    #3
  4. PoetStorm

    James Love Guest

    Hi,

    I would send the .exe file to Mcaffee though web immnune
    https://www.webimmune.net/default.asp or E mail to them at
    so they can check it and add defs if needed.

    Cheers

    James
     
    James Love, Jan 12, 2004
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.