Did a stupid thing

Geoff1965 · 14-05-2005, 06:47

Hi all, nice to meet you. I did a dumb thing yesterday, put a disc into my A drive which I believed to be blank but it actually gave my PC 2 viruses. Turns out it had been given to me by the local library a while back, to save the work I'd done, when I was in there and their pcs were going down. Lord alone knows who had it before and what they were up to but I digress.

Anyway, I aquired a [Win32.]Qozah A.3361;

and for good measure a vbs redlof.

I run Zone Alarms Security Suite and straightaway it repaired the redlof file but it took me 2 sweeps to zap the Qozah virus, once to zap it and once to take it out of system restore (which I'd forgot to disable during the first sweep). I didn't even know I had the Qozah until my natural caution prompted me to do a byte level scan.

To cut a long story short, with system restore disabled I went on to to do a third byte level sweep with ZA anti virus. It took over 2 hours but came up clean. I then did a full scan with Panda Active Scan, another 2 and a half hours but again, clean, and for good measure a scan with Trend Housecall free scan, clean again. Microsoft antispyware tells me theres no Trojans lurking, so, and I know this maybe a stupid question, have I about covered it? Can I relax now with 3 scans coming up blank or is there something else I need to do?

Geoff

paulyoung666 · 14-05-2005, 07:55

hi and

to the site , covered it i reckon , anyone else reckon different !!!!! , hope you enjoy your stay here btw

Toto · 14-05-2005, 08:53

Quote:

Originally Posted by paulyoung666

hi and

to the site , covered it i reckon , anyone else reckon different !!!!! , hope you enjoy your stay here btw

Nope, he's done what he aught, the only other option would have been to do a full format and re-install.

Lesson learned I hope

AndrewJ · 14-05-2005, 09:29

Scanned scanned and scan again gonna be the sod though, run a scan with spybot 1.3 and Adaware Se 1.05 they work well together and find things Microsoft Antispy tends to leave out. Both are available free on www.download.com.

Geoff1965 · 14-05-2005, 16:10

Well I opened my pc up today and all hell broke loose. A black box opened up entitled Wndows:C TSC EXE and scrolling down came hundreds of lines of text saying "Worm"..then some sort of title..."pattern running" or "Trojan", then the title, "pattern running". I've tried Go Back, to no avail. Seems to me I need to find out what the hell it is before I can deal with it, but how, if Panda, Trend and my ZoneAlarms security threat didn't pick it up yesterday. I have a recovery disc as a last resort but I'd rather not use it if possible...I'm at a complete loss as to where to even start. Can anyone help?

paulyoung666 · 14-05-2005, 17:13

hi and

to the site as well , it could be some sort of boot sector virus , really need some more info to go on if you can

Geoff1965 · 14-05-2005, 20:11

Thats all I can tell you really, other than what I wrote yesterday. None of my anti virus scans seem capable of oicking it up but it is there. I really dont know how to proceed, other than reformatting.

14-05-2005, 20:22

Quote:

Originally Posted by Geoff1965

Thats all I can tell you really, other than what I wrote yesterday. None of my anti virus scans seem capable of oicking it up but it is there. I really dont know how to proceed, other than reformatting.

does it run when you boot in safe mode?

- if not you could try the scans from there - and 'spyware' scans as well, have you tried it with e.g. adaware or spybot?

Geoff1965 · 14-05-2005, 21:57

I will try that, but someone has suggested that it could be Trend Micro running its scan, looking for patterns. Surely it would say Trend though? I'be never really used Trend but I cant really see it myself....

15-05-2005, 00:26

Quote:

Originally Posted by Geoff1965

I will try that, but someone has suggested that it could be Trend Micro running its scan, looking for patterns. Surely it would say Trend though? I'be never really used Trend but I cant really see it myself....

you could always paste an 'hijack this' report in the thread - cable forum is not famous for solving the results, but as a clearing house, someone can usually help ........

nffc · 15-05-2005, 00:30

Get the free anti-virus Avast and run a boot-time scan.

Geoff1965 · 15-05-2005, 08:54

Everything comes up clean and I'm starting to think I'm worrying over nothing. Question....could Windows:C TSC EXE be Trend micro systems doing a scan for virus patterns? I ran a Trend scan and a Panda scan too before all this.

What's Hijack this? Never heard of it.

Thanks

Toto · 15-05-2005, 23:32

Quote:

Originally Posted by Geoff1965

Everything comes up clean and I'm starting to think I'm worrying over nothing. Question....could Windows:C TSC EXE be Trend micro systems doing a scan for virus patterns? I ran a Trend scan and a Panda scan too before all this.

What's Hijack this? Never heard of it.

Thanks

Not sure if thats trend micro running.

HijackThis is a tool that checks all the changes made to Internet Explorer, its used by people to send analyst reports to compter experts when they are having problems with pop ups, browser help objects and rogue search engines appearing on their IE browser.

Geoff1965 · 16-05-2005, 13:33

Well I ran Trend 2 more times and each time before it starts its scan it says reboot so Trojan System Cleaner can remove trojans. TCS = Trojan System Cleaner (I hope). On their site it also talks about pattern search engines and thats what this EXE appears to be looking for, so it all adds up. I will take a look at hijack this though. Could you tell me where their site is please?

Nemesis · 16-05-2005, 13:58

http://www.liutilities.com/products/...sslibrary/tsc/

TSC.EXE is part of the Trend system, nothing to worry about.