Trojans

Excellent :)

Broni - I have a couple small issues that started after we did all the scans. Maybe this question should be in another forum, but it started after the last couple scans.

The settings on the keyboard and the mouse wll not stay set, each time we log on we have to go to control panel and reset everything. Also the usb drive will not start automatically any longer, we have to manually start it.

How can I fix these so they keep the settings? Thanks.

To get more attention, it'll definitely be better to start new topic under Windows section.
Access to malware section is very limited.

Thanks Broni - I will post in the other section.

Sure thing :)

The Tr/Crypt.ZPACK is back!!

It popped up yesterday afternoon when we logged on. This was the first issue we have had since the cpu was cleaned last week. I have no idea where it is coming from.

Now what do we do? Thanks.

Could this TR be on our USB stick? If so would we just toss that one and get a new one?

clean the stick.

Thanks Train. Do I need to re-do all the scans to get the booger off the CPU again? It was found by Avira at boot up and the stick was not in use.

I don't mean to beat a dead horse here, but I searched on this hateful TR and it seems that Avira may be giving a false positive on this. Has anyone else found this to be true? I also read it on the Avira forum, but cannot find it now.

If it is a false positive sure would save a lot of hassles trying to find it.

Can you post what exactly is reported by Avira, and what's the location of infected file?

I will post it as soon as it pops back up. Don't think it gives a location, but it asks if I want to deny access or allow. Avira is the only scan that finds it. I did read some place that there are several false positives but supposedly Avira has a fix for it.

Thanks Broni.

OK. Keep us posted :)

Ok, it only shows up at bootup or with a avira scan. The location is C:\\Windows\system32\rasalobj.dll. I searched for this and it did not show up. I read on Avira that it may be a false positive (I do not like the "may" part) and it should have been fixed in the last update, but mine is updated daily.

Thanks for any info.

rasalobj.dll doesn't yield any results on Google, so it can't be any legit file.
Let's see...

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Vista users:: Right click on SystemLook.exe, click Run As Administrator
• Copy the content of the following box into the main textfield:
  
  Code:

  ---

  :filefind
rasalobj.dll

  ---

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt