Re: Trojan horse Downloader.Stubby.A

From: Kent W. England [MVP] (kwe_at_mvps.org)
Date: 12/07/03


Date: Sun, 7 Dec 2003 14:00:39 -0800

I think we can deal with hijackthis reports in this forum, so long as
users follow the recommendations that spywareinfo suggests:

1) download and run SpybotSD and/or Adaware and remove all known spyware
2) update your anti-virus, run it, and remove all known viruses
3) download and run hijackthis and create a report to post here

That way the hijackthis report deals only with a possible new bug or a
particularly difficult trojan or a new variant of CWS.

-- 
Kent W. England, Microsoft MVP for Windows Security
"Bill Sanderson" <Bill_Sanderson@msn.com.plugh.org> wrote in message
news:%238Ph4VeuDHA.2168@TK2MSFTNGP10.phx.gbl...
> OK - that's clear, and I agree that the tool is outstandingly well
written
> in terms of safe operation.  I need to copy your canned description of
what
> to do for use in some other groups, I think.
>
> What I'm not comfortable with doing is promoting responses to the use
of
> this tool in this forum, I think.  (meaning on my part--not on yours!)
I'm
> not clear we have the expertise to handle the volume of requests we'd
get,
> and I still feel that ad-aware and spybot handle the majority of
issues
> here--but I haven't kept a careful count, and since someone recommends
> ad-aware for nearly every post here, it's clear there isn't always a
lot of
> careful analysis behind that recommendation, nor always feedback about
the
> result!
>
>
> "Mike Burgess" <winhelp2002@spamthis.com> wrote in message
> news:uMGlKBbuDHA.2508@TK2MSFTNGP12.phx.gbl...
> > Bill,
> > You are right that HT is a diagnostic tool.
> > However on the link I provided the OP, it states to run HT, then
visit
> > their Forum, for expert assistance.
> >
> > When a user selects an option for HT to remove, it unloads any DLLs
> > and EXEs involved, then deletes the needed values, etc.
> >
> > It is an outstanding tool for spotting/removing Trojans,
spyware\adware,
> > etc.
> > http://www.spywareinfo.com/~merijn/htlogtutorial.html
> >
> > As Ad-Aware and SpyBot S&D can no longer keep up with the increased
> > amount of (almost daily) threats, HT can be used "with assistance".
> >
> > Give it a try, as it *only* scans on the first run, HT does NOT
remove
> > anything
> > unless the user selects a option. Note: HT automatically creates a
backup.
> >
> > Better yet, take a few minutes and read thru the postings at the SWI
Forum
> > or one of the many, many others, you'll be amazed at the amount of
> > infections!
> > http://forums.spywareinfo.com/ (server down at the moment)
> > http://forums.tomcoyote.org
> > http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi
> > http://boards.cexx.org/
> > http://www.computercops.biz/forums.html
> > ____________________________________________________________
> > Mike Burgess  [MVP Windows Shell\User]
http://www.mvps.org/winhelp2002/
> > Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a
HOSTS file
> > http://www.mvps.org/winhelp2002/hosts.htm [updated 12-01-03]
> > Please post replies to this Newsgroup, email address is invalid
> > --
> >
> > "Bill Sanderson" <Bill_Sanderson@msn.com.plugh.org> wrote in message
> > news:uIDdGgIuDHA.3116@tk2msftngp13.phx.gbl...
> > > Hey Mike - I should have tested HijackThis myself--but can you
give a
> > simple
> > > explanation?
> > >
> > > I've been assuming that HijackThis is primarily a diagnostic tool.
I'm
> > > getting the feeling from this and similar posts that it is also an
> active
> > > removal tool--what's the story?
> > >
> > > "Mike Burgess" <winhelp2002@spamthis.com> wrote in message
> > > news:uIGJbaIuDHA.1996@TK2MSFTNGP12.phx.gbl...
> > > > MER-44,
> > > > "Downloader.Stubby.A" is fairly easy to get rid of ........
> > > (abetterinternet
> > > > parasite)
> > > > AVG will only identify the culprit .dll .......
> > > >
> > > > Dealing with Unwanted Spyware, Parasites, Toolbars and Search
Engines
> > > > http://mvps.org/winhelp2002/unwanted.htm
> > > > Note: make *sure* to follow-up with HijackThis!
> > > > ____________________________________________________________
> > > > Mike Burgess  [MVP Windows Shell\User]
> http://www.mvps.org/winhelp2002/
> > > > Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a
HOSTS
> > file
> > > > http://www.mvps.org/winhelp2002/hosts.htm [updated 12-01-03]
> > > > Please post replies to this Newsgroup, email address is invalid
> > > > --
> > > >
> > > > "MER-44" <anonymous@discussions.microsoft.com> wrote in message
> > > > news:060f01c3b882$2afdef10$a401280a@phx.gbl...
> > > > > I just got a trojan virus and can't get rid of it.  The
> > > > > norton anti-virus software that I have didn't pick it up
> > > > > but a recently downloaded version of AVG Anti-Virus 7.0
> > > > > did. I can't figure out how to get rid of it and would
> > > > > like some help. The trojan is "Trojan horse
> > > > > Downloader.Stubby.A ".  Thanks MER-44
> > > >
> > > >
> > >
> > >
> >
> >
>
>


Relevant Pages

  • Re: "IE has experienced a problem and needs to close" error
    ... HijackThis are two which you missed using. ... Spybot S&D also needs some help, but if it finds anything and displays them ... Other tutorials for Spybot S&D ... >>Check for Spyware - How-to ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Links that keep haunting me...
    ... Download HijackThis, free, here: ... Another excellent program for this purpose is SpyBot Search and Destroy ... you might want to consider installing the SpywareBlaster and ... SpyWare Blaster is not memory resident ... ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Web pages not loading on XP - a virus ?
    ... Create a separate folder for HijackThis, such as C:\HijackThis - copy the ... Spybot S&D has an install routine - run it. ... First update it, ... Spyware Warrior: ...
    (microsoft.public.windowsxp.network_web)
  • Re: Exploit Trojan destroying Content IE5
    ... ugraded Adaware and Spybot has ... HijackThis, so I left it all alone. ... >Before you try to remove spyware using any of the ... >Other tutorials for Spybot S&D ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Internet Dialler wont hang up
    ... Create a separate folder for HijackThis, such as C:\HijackThis - copy the ... Spybot S&D has an install routine - run it. ... First update it, ... Spyware Warrior: ...
    (microsoft.public.windowsxp.network_web)