Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1041
  • Last Modified:

removing malware and trojan

Okay, I am a bit confused as to what my next step should be.  I am a network administrator/network security person for my company.  We have three servers, DC01, DC02 and EX01.  We use Windows 2003 for our servers, XP for workstations and Exchange 2003 for exchange services.  Last week we had someone do a baseline config on the HDD (servers).  When they returned and we put back online we noticed some issues.  When you double click to open the shared drive (on DC02) we get a DOS window that says at the top left PjSiEq.eXe.  I looked this up and noted it to be malware.  So, I ran malwarebytes on each server and workstation.  On the workstations I get "hijack.connectioncontrol" and on the server (DC02) I found a trojan (trojan.vundo) in the shared drive.  I quarantined both things but am having the same issue.  how do I return my system back to normal?

I ran my Norton and found nothing on servers or workstations.  I ran the Malwarebytes again and now find nothing on servers but still have the "hijack.connectioncontrol" on the workstations.  My users need the share drive.  Any assistance will be greatly appreciated.

This is a difficult one.
0
lpetrowicz
Asked:
lpetrowicz
1 Solution
 
kaarCommented:
you could download the Avira rescue boot CD and run on the workstations, choosing the rename options on threats found.

Cheers
Fabio
0
 
rockiroadsCommented:
have u tried running mb in safe mode?
0
 
rockiroadsCommented:
ha, wait a mo. I checked mb forums and it seems it might be a false positive. Something to do with group policy.
See this http://forums.malwarebytes.org/index.php?showtopic=45986
0
Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

 
bigg_oilCommented:
check the registry key

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel\ConnectionsTab (Hijack.ConnectionControl) -> Bad: (1) Good:

malwarebytes belives this to be a false positive
0
 
rockiroadsCommented:
mb has reported it to be a false positive so maybe you could try running another spyware checker and see what that produces. There is no harm in having two, Maybe run hijack this as well
0
 
lpetrowiczAuthor Commented:
I have read that and that only solves the minor workstation thing.  What about the bigger problem; when I click on my share drive and a DOS window opens reading PJSIEQ.EXE?  How do I indentify what the cause of this is if I have already run Antivirus and Malwarebytes?
0
 
optomaCommented:
0
 
rockiroadsCommented:
you have tried running full scan in safe mode right?
as I said before, it might be worth trying out another spyware like superantispyware (has a free version). one of their pages also mentions PJSIEQ.EXE. http://www.superantispyware.com/malwaredailyfiles/2010-03-01.html
0
 
Sudeep SharmaTechnical DesignerCommented:

If the exe PJSIEQ.EXE is in your user profile and then probably your system is infected by virus named DunDun (W32/DunDun.a) (W32.SillyFDC).

Click on Start --> Run --> Type %UserProfile% and click ok. A window would open and you would see exe named PJSIEQ.EXE there (make sure that you select Show Hidden and System File in Explorer Folder Option)

More details:
http://www.threatexpert.com/report.aspx?md5=605787093d636b0f3c4720a88c9e5a89

Sudeep
0
 
lpetrowiczAuthor Commented:
we did find a W32.Silly in one of our profiles.  Thanks.
0

Featured Post

Transaction-level recovery for Oracle database

Veeam Explore for Oracle delivers low RTOs and RPOs with agentless transaction log backup and transaction-level recovery of Oracle databases. You can restore the database to a precise point in time, even to a specific transaction.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now