Need info on trojen

edited February 2007 in Science & Tech
The web site I go to and look up trojens is down so I need some one
from AVG to tell me what those trojen horse do.

I posted a screen shot at imageshack.

001xc9.jpg

002yq1.jpg

I thought Windows 98SE does not have a Winlogon.exe file ?

The victims computer and tech working on the problem is away so I'm
posting.

Also some times there is problem with the Control-Alt-Delete has web
site will lock up and every thing else works or other web sites but
doing a Control-Alt-Delete on the bad IE will lock the computer up .

I don't know if this is viruses is obtain the control of the secure
attention key or not.Well doing search Winlogon is the component of
Microsoft Windows operating systems that is responsible for handling
the secure attention key, loading the user profile on logon so on.

But I don't thing Windows 98SE has Winlogon.exe file .It seems to be
in a C:\Windows\System32 folder this Winlogon.exe file

--

Comments

  • edited February 2007
    Well the first thing I can tell you is that the file name in question is named WINL0GON.EXE Notice the zero for the O in logon?
  • edited February 2007
    Yes, it seems that the winlogon is fake. Try to search if there is another winlogon without the 0 .
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    Stop running windows 98. That's your first step. Alot of viruses and trojans work especially well on that useless and unstable bundle of age. NT's the way to go. 2000 or XP, or Vista if you can fight your way through Microsoft's legal loarde of cattle cakes.
  • edited February 2007
    Many of the people have problems with the netbios thing.
    ZoneAlarm prevented your computer from connecting to NetBIOS port 138 on another computer

    Well I don't understand what this NetBios datagram is.

    http://fwalerts.zonelabs.com/fwanalyze.jsp?record=ZLN28220854585106-1013/1debcf30110a51ef8ae0148&tab=overview
    ZoneAlarm has successfully stopped Internet traffic from leaving your computer. No breach in your security has occurred. Your computer is safe.

    What happened
    Your computer has attempted to use NetBIOS port 138 to connect to another computer, located at address 192.168.0.2.

    Should I be concerned?
    No. 192.168.0.2 should be an address on your local network. One possible explanation for the alert is your computer is attempting to renew an IP address from a DHCP server. Both DHCP and NetBIOS are common on most local area networks using Windows platform domains. The address could also belong to a DNS server or another LAN-specific server.
    What should I do?
    If 192.168.0.2 is an address on your LAN, you should add your Local Area Network to your Trusted Zone. When security is set to Medium (the default in the Trusted Zone), ZoneAlarm allows NetBIOS communications to pass through the firewall. High security denies NetBIOS communications. To avoid seeing this type of alert in the future, please refer to the ZoneAlarm help files for instructions on adding hosts and IP addresses to the Trusted Zone. If 192.168.0.2 is not on your local network, then perform an updated anti-virus sweep of your computer.

    We have some computers that have Winsows 98 and Windows 2000 what is going on?

    Well the first thing I can tell you is that the file name in question is named WINL0GON.EXE Notice the zero for the O in logon?

    I thought there was a database on the internet wher you can look up trojens ? I look up stuff on Mcafee but not all trojens are there or may times message boards fore anti-trojens to look up help go down.



    Note my computer have some virus now and so is some of the computers in the house what should I do? And my friends house has virus .He is IT guy but likes to format that remove the virus .Well what do we do:eek:
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    Go buy XP home or something. It's been..10 years since 98 came out? Seriously dude. Don't you know anyone with Windows 2000 or something? 98 has more viruses, trojans and exploits than any of the NT-based platforms added together. And alot of the time, since it's 98, you don't just REMOVE things. You are probably gonna be forced to format.

    Oh and a tip for not getting viruses/trojans/exploited. Stop going to warez/porn sites.
  • edited February 2007
    We kinda have a topic of this going .

    winlogon.exe is a imported file in Windows 2.x I don't know if
    Windows 98 uses this file .Most Web sites it is hard to get
    information on this file.

    If windows 98 use this file that means this malware has infected a
    imported file .I don't know about the other file but it is doing some
    think to IRC looking at pictures is it malware or not?

    Or has it infected a imported file ?

    http://en.wikipedia.org/wiki/List_of_Microsoft_Windows_components
    http://en.wikipedia.org/wiki/Winlogon
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    XP uses it for something. No idea what though. Get off 98. That'll solve that problem. And if you're worried about Trojans, stop downloading porn and warez and get a real virus scanner. Like Common sense.

    No offense man, but smart people don't get caught with their pants down. I've been a Network Administrator going on ten years now. No machine I've owned, or had in my house for more than a week has been vulnerable to any kind of attack, virii or Trojan in the existence of my new network. (I've had three, first one was bullet proof but obsolete, second one my router died so I bought the switch I use to this day.) I'll admit I've done some stupid crap willingly to get an idea of how to fix something, but I do it in a controlled manor, on a separate network in my garage.

    Also, I want to show you something.
    Fortesig.jpg
    Open that in WINRAR. You're gonna have to force it. Then you'll see how easy it is to bind code to images. I included something safe, just a text file. But if it's that easy to add an archive inside of an image, imagine how easy it would be to add executable code. Please enjoy my work in progress.
  • edited February 2007
    XP uses it for something. No idea what though. Get off 98. That'll solve that problem. And if you're worried about Trojans, stop downloading porn and warez and get a real virus scanner. Like Common sense.

    I don't think you understand some of the computers in the house the family use have malware and this is one of them.Most of the computers running windows 98 are spars.

    No offense man, but smart people don't get caught with their pants down. I've been a Network Administrator going on ten years now.

    How many malware have you got? We had some malware problems from msn groups and yahoo groups .Also one of my family got malware going to a hip-hop web site.I have seen people get malware from myspace.

    Well I would say most of the malware comes from porn sites or free music and free movies .And other free games and free stuff.Many people say ps2s and kazaa have malware.

    We also had problems of people in are family get malware in a e-mail and spam e-mail.
    No machine I've owned, or had in my house for more than a week has been vulnerable to any kind of attack, virii or Trojan in the existence of my new network.

    What do you mean by vulnerable to any kind of attack are you saying you never got malware at home or work?
    (I've had three, first one was bullet proof but obsolete, second one my router died so I bought the switch I use to this day.) I'll admit I've done some stupid crap willingly to get an idea of how to fix something, but I do it in a controlled manor, on a separate network in my garage.

    Why did you what to do it on a separate network?
    Also, I want to show you something.

    The thing is like I was saying to other member you don't have to click on any thing to get malware all you have to do is go to a bad web site.The problem is Windows programming is bad and malware find its way in through exploits ( bad programming code ).
    Open that in WINRAR. You're gonna have to force it. Then you'll see how easy it is to bind code to images. I included something safe, just a text file. But if it's that easy to add an archive inside of an image, imagine how easy it would be to add executable code. Please enjoy my work in progress
    .

    But you don't have to click on the images or download it to get malware:eek: Well may be there are ways that there can be executable code in the HTML or pop ups?

    Or there may be pointers in the HTML that download files from other area of the server.
  • kryystkryyst Ontario, Canada
    edited February 2007
    I can say in about 15 years of using a computer I've only had maybe 2 viruses ever and that was in the beginning before anyone ever really knew what they were or how they work.

    I've been an admin now for about 8 years servicing a network of about 100 users. Since the early days I've never had any viruses or malware on my home network and in the 8 years I've been an admin no work network I've been in control of has every had any spy or malware.

    It's not that hard to secure things. You just need to be smart about what you are doing and where you are going.
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    Totally Kryyst. And it comes to my attention that I posted something lastnight, but I've no idea where. I should really stop drinking.

    Anyway. My machine has, and always WILL be clean. I have taken the six main steps to avoid infection of any malicious or unwanted code.
    1: I don't use Internet Explorer.
    2: I run Perl-based scripts on my switch.
    3: When browsing a site I can't get immediate DNS data for, I use TOR/Vidalia.
    4: Policy based, MAC-Authority access tables. Only certain computers can even use outside ports.
    5: Read as many whitesheets from ZDNET as I can, to stay on top of the latest structure.
    6: When in doubt, don't. If you think just for a second that you could be vulnerable, don't do whatever you were.

    Software does not a firewall make, nor does a firewall make security. The user must know everything about the endeavor or be doomed to failure. It also helps to stay on top of the edge of stable operating systems, because as things age, more holes are found. I remember when I switched to 2000, not two weeks later, the entire timewarner 24-162-.cs.hot.rr got hit. I was 24.162.152.55, and since the attack was literally designed to hit computers running 98, not only did I not notice it, I got a decent ammount of work because of stupid people not securing themselves or getting the necessary updates that could've prevented this.
    Let me leave you with some wise words. "Those who do not take every step to prevent chaos, contribute to it in their own way."

    And Zerg. You're a moron. I was doing that to prove a point. That a simple image could be a host of malicious code. I've been told many a time not to flame peope, So thank you for playing Firearms.
  • edited February 2007
    Let me leave you with some wise words. "Those who do not take every step to prevent chaos, contribute to it in their own way."

    No I was asking questions on how it works.
    And Zerg. You're a moron. I was doing that to prove a point. That a simple image could be a host of malicious code. I've been told many a time not to flame peope, So thank you for playing Firearms.

    Where was I flaming you:rant:

    Is it not true that hackers can get in or give you pop ups or malicious code by your IP address or port number?
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    I'm not flaming you yet. Calling you a moron is a matter of opinion. Lemme put it to you like this. It is my experience that it is more difficult to attack blind than to attack a target you know. Hackers, or Crackers as the term is correctly known as, can do a number of malicious things to compromise your security. One being letting you do the work for them. I'm not gonna say that you download illegally, but that's the prime way of infection for 60% of these script kiddies. Trojan horses are all they know. If you're dumb enough to get infected, and do no research on how you did it, then you deserve it. If you're too dumb to go to google and type in what you're after, or what you want to prevent, then you deserve all that befalls you. Yeah, we could hold your hand, but what would you learn, other than we could solve your problems for you. No one helped me, I had to help myself. It took a long time, but it was more rewarding when I learned what I needed to do by myself. If you want a demonstration what a true cracker can do, merely go on an alt.binares newsgroup IRC channel and call someone named Genma a profane word that involves at least one racial slur. I'm sure he'll provide you a hands on demonstration, and a very nice light show. Or if you just want to learn, google is your friend, and I do recommends signing up for the ZD.NET security white pages. Knowledge is power, and knowing is half the battle. Learning the hard way provides more respect for what you learned.

    In closing, I thank you for your patronage to these lovely forums, and wish you the best of luck in all your endeavors, but if you want to earn your Network Survival badge as it were, then it's time to hit the books.
  • edited February 2007
    I'm not flaming you yet. Calling you a moron is a matter of opinion. Lemme put it to you like this. It is my experience that it is more difficult to attack blind than to attack a target you know. Hackers, or Crackers as the term is correctly known as, can do a number of malicious things to compromise your security. One being letting you do the work for them. I'm not gonna say that you download illegally, but that's the prime way of infection for 60% of these script kiddies. Trojan horses are all they know.
    I did not say you are flaming me or that I was flaming you but when you are calling me a moron and quote me that tells me some thing is wrong with that post and I thought you may have thought I was flaming you.So that see if I understand you saying I should not be using my computer because I don't understand how malware works?

    If you're dumb enough to get infected, and do no research on how you did it, then you deserve it. If you're too dumb to go to google and type in what you're after, or what you want to prevent, then you deserve all that befalls you. Yeah, we could hold your hand, but what would you learn, other than we could solve your problems for you. No one helped me, I had to help myself. It took a long time, but it was more rewarding when I learned what I needed to do by myself.

    I'm not saying you are spoon feeding me because that will be many and many post to I understand malware I was only asking you is it true all the hackers need is my IP address or port number?


    If you want a demonstration what a true cracker can do, merely go on an alt.binares newsgroup IRC channel and call someone named Genma a profane word that involves at least one racial slur. I'm sure he'll provide you a hands on demonstration, and a very nice light show. Or if you just want to learn, google is your friend, and I do recommends signing up for the ZD.NET security white pages. Knowledge is power, and knowing is half the battle. Learning the hard way provides more respect for what you learned.

    So ZD.NET security white pages is good start at http://review.zdnet.com/

    In closing, I thank you for your patronage to these lovely forums, and wish you the best of luck in all your endeavors, but if you want to earn your Network Survival badge as it were, then it's time to hit the books.

    What is good book to start reading? And I have bean nice on this form so what is the problem.
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    Who are you, my Publisher? Separate everything I say you break down into little analytical groups and grade me accordingly of your inability to understand simple English?

    Right. Yeah, ZD.NET is like the best place to learn anything, and I mean anything. I've been getting their security notices and whitesheets for going on..four years now? It's been a long while. I've been getting them for ages, at two boxes, my work box and my Gmail account. Jesus. Has it really been that long. Damn work sucks. Anyway, The best way to do things is the hard way. Wanna learn something about propane or propane accessories? Burn something. Wanna learn about explosives? Blow something up, IF you're licensed to. Never break the law. Wanna learn what happens when you put DC 230V through a 9V AC telephone? Do it. Best way to learn is to do it the hard way man. Best advice I can give.
  • edited February 2007
    Look man I had it with your smart remarks or intoxicated messages.It looks like you like groups to show of , than take the time and post messages like a smart scientist than hot shot kid learning IT.:rant:
  • LINLIN Tri_State Area
    edited February 2007
    let's keep it civil, guys...

    much obliged. :)


    LIN
  • edited February 2007
    I thing we should create a flame thread !!!!
  • kryystkryyst Ontario, Canada
    edited February 2007
    airoh69 wrote: »
    I thing we should create a flame thread !!!!

    That doesn't help anyone. Plus from previous experiences the flames usually spill out everywhere else.
  • Your-Amish-DaddyYour-Amish-Daddy The heart of Texas
    edited February 2007
    Yeah. And even though I'm trying not to, Somehow it seems to slip through. But atleast I haven't gotten into my normal bag of mean and disrespectful words.

    To sum this all up; Zerg, if you're still learning, then hit your books. We aren't guaranteed to know your answer. I don't post here when I have a critical problem, I post AFTER I solve it or get the information I know, unless it's minor. Like the Hitachi Hard drive problem. It's minor, and Hitachi won't do anything about it. It just happens to annoy the ever loving crap out of me. All I'm saying is; if you're studying a field, say medicine. All you can really do to increase your knowledge of medicine is to study the field with the proper tools.
Sign In or Register to comment.