I keep finding this trojan on my PC...WHY?

[XPerties]

OK I use the trojan killer called :The cleaner" which is a great app, but once a week or twice a week I run it and I keep finding this trojan called "VariousKeyLoggers" Now I ve read up on it and know it tracks your key strokes but why the hell does it keep coming back....and this is woerd.....Supposely were the cleaner is finding it is in e:windowsupdate/"code for the file"......Now I dont even have this directory and my view files and folders are on "show all extensions and files". Its triping me out...Any suggestion from anyone....especially AaronXP?

-Chris

[Guest LouCypher]

Do you frequently use filesharing applications like AudioGalaxy, BearShare, Morpheus/Kazaaa/Grokster, Napster, etc? I get virii and trojans occasionally disguised as MP3 and "keygens". It doesn't matter where the cleaner finds them because once they're active in memory they usually move themselves to a less noticeable place.

[FthrJACK]

you probably have an undetected trojan on your pc, theres a LOT that norton and many trojan scanners wont find, the keyloggers are being uploaded by the person operating the trojan, try run [b:f61e7143f5]netstat -a[/b:f61e7143f5]

from the cmd prompt sometime and tracert the ip numbers you are connected to, the trojan is probably in one of the applications you use a lot and so is re-infecting you when you format... this is the same set of keyloggers you got before the format isnt it?

failing that.... as its showing up a non exsistent dir maybe its just cleaner being funny on XP? does it show them up everytime you run it? run it, delete the loggers and run it again.. they still there? (do that with your modem turned off!)

[Rick]

Quit having sex near the computer and you won't be finding trojans on it! LOL I have been sharing files with Chris so now I had better get this prog. and see what I come up with.

Rick

[XPerties]

This is the netstat -a picture. Ran scan again didnt come up, but about 2 weeks ago I found it and I cleaned it, now it came back....but its gone for now.

[Guest LouCypher]

Any idea what is listening on port 8116? Seems kind of odd that one is open.

[XPerties]

I dont have a clue, how would I find that out...and now that everyone knows this....duh posting it on the forums...Im open for everyone. s***!

-Chris

[Guest LouCypher]

Does your firewall have a "status window" like Tiny? I know NIS/NPF and @Guard do, not familiar with the others. The firewall should be able to map port to application and tell you what has it open.

[LS_Dragons]

Check to see if you now have an autoexec.bat file. I got a virus from a 'friends' computer I was helping configure - plugged it into my network and set up a share and WHAM - SirCAM all over the place. I kept cleaning but it kept coming back Seems is created an autoexec file with the command @c:recycledfilename. This file did not show up in recycle bin - but Norton kept alerting me it was there. Finally managed to clean the system - but took hours. Also - make sure you disconnect from all networks before cleaning - and clean other systemso n your network (if there are more / you have a network).