View Single Post
Old 30-08-2006, 01:28   #2
ADd
Inactive
 
ADd's Avatar
 
Join Date: Apr 2006
Location: Land of the free
Posts: 308
ADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond reputeADd has a reputation beyond repute
Re: tspy - Trojan keylogger

Hi Matt D, firstly the only chink in your armour was a lack of firewall. That is because Windows firewall only blocks incoming attacks. So if you download something nasty via your browser (and java can be exploited this way even through firefox) then the firewall will not help you. A software firewall like Zonealarm, Sunbelt Kerio, or Outpost will enable you to block both incoming, and outgoing. Thus if something is downloaded, which attempts to contact a site on the web to fill your HD up with more nasties, the firewall should let you know, and allow you to block it.

I am surprised that Kaspersky did not detect this threat, as it is very good. another way of protecting yourself is doing online scans, like trendmicro, panda. To give you a second opinion. Basically a AV is only as good as its definitions.

Apart from that, without seeing a log/report from the cleaning of the infection I can't give you any more info. This is because 'tspy' seems a generic name for a number of keylogging trojans, and also it is important where this file was located.
Therefore I would suggest you post a HijackThis log at one of the following ASAP forums:
http://www.malwareremoval.com/a-sap.html

You will get free help, and the guys/gals will ensure you system is cleaned in the best possible manner, they are professionals with many years of experience.
Finally I would advise that you backup you personal data regularily - onto cd, usb memeory stick etc, so that if in the future you need to reinstall you have your info handy (imagine if you had a hardware failure)
One point, it is possible this was a false positive, hence why Trend found it and Kaspersky didn't - so a double check at one of the forums would be my best advice.

Edit>>If you want to know more about ASAP see here:http://asap.maddoktor2.com/
ADd is offline   Reply With Quote