locked
Help I got a virus RRS feed

  • Question

  • The Virus I got is TrojanDownloader:Win32/Gida.A

     

    Windows Live One care removes it but every few days it comes back

     

    Any Ideas how to fix this complete scans don't detect nothing after one care removes and cleans up

     

    UPDATE: After some investigation I discovered the trigger is anything that .swf (Shockwave) enabled content like Ad Banners or any other shockwave Site.

     

     

    Monday, January 14, 2008 6:13 AM

Answers

  • There It took a Securty competors removal tool to get rid of the dang thing and the tool showed the exact path of the dang thing vista running as it's happy self.

     

    I like to thank Symantec Trojan Uploader removal tool It fixed the re-acurring mess

    Wednesday, January 16, 2008 5:38 AM

All replies

  • I fixed that Virus I removed Shockwave & Flash and now I'm getting BSOD on vista the virus is crashing the OS now because One Care couldn't removed the program/app thats messin with Vista so I removed the trigger APP Shockwave for now.

     

    Now I'm getting BSOD or something crashed and report sent.

    Monday, January 14, 2008 6:48 PM
  • Go to the logging tab under change settings and create the log. In the report that opens, check to see where the threat has been detected.

    -steve

     

    Monday, January 14, 2008 7:04 PM
    Moderator
  •  Stephen Boots wrote:

    Go to the logging tab under change settings and create the log. In the report that opens, check to see where the threat has been detected.

    -steve

     

     

    It cleans up the virus every time detected removed/clean up

     

    But after a re complete scan after it does all that I might be browsing around on the web hotmail or any ad banner site with swf and the virus pops up One care removes and clean up a full scan says no potentially harmful items found but a few days later I'll come across a site or swf ad banner and it does it all over again it won't go away.

     

    I'm on my xp home computer it's really old and slow but right now running better than my Vista computer which has been doing a Complete virus/scan for 14hrs but only at 50% It's on my E:\ drive scanning the dreaded vista bakup files the system is slow and hung My friend calls it beating a dead horse to death it's only a 2.66ghz, 1gig of ram and  2 320gig hard drives with one virus that won't go away. The Gateway  has about had it hopefully later this year I'll be able to get a brand new full vista Ultimate system. I'll add more to this later this thing really slow. All this and I'm moving too.

    Monday, January 14, 2008 11:42 PM
  • But where is it removing the virus from? It may be that the infection is residing in a file that is activated when Flash loads.

    -steve

     

    Tuesday, January 15, 2008 2:33 AM
    Moderator
  •  Stephen Boots wrote:

    But where is it removing the virus from? It may be that the infection is residing in a file that is activated when Flash loads.

    -steve

     

     

    Here's the Log

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

     

    Windows Live OneCare found potentially harmful or unwanted software on your computer
    Threat Name: TrojanDownloader:Win32/Gida.A
    Detection Date and Time: 1/14/2008 1:03 AM
    File Name: C:\Users\Mikro\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BOJ86R5Q\gnida[1].swf
    Threat Severity: Severe
    Threat Category: Trojan Downloader
    Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS)
    Threat Status: Removed
    Tuesday, January 15, 2008 8:07 AM
  • I snipped out most of your log, but noticed that each entry was indeed for that same .swf file.

    I'll suggest you contact support, but I'll leave this thread unanswered until we know more about this.

    -steve

     

    Tuesday, January 15, 2008 7:13 PM
    Moderator
  •  Stephen Boots wrote:

    I snipped out most of your log, but noticed that each entry was indeed for that same .swf file.

    I'll suggest you contact support, but I'll leave this thread unanswered until we know more about this.

    -steve

     

     

    Since this detection/removal My computers performance has gone to Hell

     

    I did call support

     

    Ticket virus issue: 1055577493

     

    the virual App Is still on my system I think

     

    One Care currently reports no problems

     

    I very worried this virus is grabbing personal info passwords and what not Windows live keeps asking me to sign in is a clue some one messing with my Windows Live ID.

    Tuesday, January 15, 2008 8:55 PM
  • I would expect that the firewall would block outbound actions by a threat that it keeps detecting and removing, Mikro.

    -steve

     

    Tuesday, January 15, 2008 9:56 PM
    Moderator
  • Found more detail on this threat, Mikro:

     

    http://www.f-secure.com/v-descs/trojan-downloader_swf_gida_a.shtml

     

    -steve

     

    Tuesday, January 15, 2008 10:02 PM
    Moderator
  •  Stephen Boots wrote:

    Found more detail on this threat, Mikro:

     

    http://www.f-secure.com/v-descs/trojan-downloader_swf_gida_a.shtml

     

    -steve

     

     

    Cool thanks but I still can't get rid of it every time I goto a windows live site with ad banners or other website One care swats at it clears it out clean till the next time Info great as long as there's a resolution to get rid of or remove the problem.

     

    Why isn't there something under the One Care site virus search area under this trojan

     

    this thing a royal pain in the ___ and there's no to yo remove it.

    Wednesday, January 16, 2008 4:31 AM
  • There It took a Securty competors removal tool to get rid of the dang thing and the tool showed the exact path of the dang thing vista running as it's happy self.

     

    I like to thank Symantec Trojan Uploader removal tool It fixed the re-acurring mess

    Wednesday, January 16, 2008 5:38 AM
  • Since you have an open support case on this, Mikro, whatever information you can get from the Symantec tool to provide to OneCare support about this infection that OneCare could not completely remove, would be very good.

    -steve

     

    Wednesday, January 16, 2008 1:52 PM
    Moderator
  •  Stephen Boots wrote:

    Since you have an open support case on this, Mikro, whatever information you can get from the Symantec tool to provide to OneCare support about this infection that OneCare could not completely remove, would be very good.

    -steve

     

     

    I found this site too after looking at the pinned info threads here. 

     

    http://www.microsoft.com/security/portal/Entry.aspx?ThreatId=-2147368057

    Wednesday, January 16, 2008 8:38 PM
  • I actually got this just after i installed Realplayer 11 an updated version that is striaght from the update tool built into it

    Tuesday, January 22, 2008 9:45 AM
  • Hi,

    I am having a problem with a Trojan Downloader too.  Windows Live OneCare removes it but it also keeps coming back.

     

    This is its name: TrojanDwonloader:JS/Renos.cw

     

    I have tried everything I know to try to fix my problem.  I have even put  sites on the restricted site list but they keep coming back and opening new web pages.

     

    I can't play my games on pogo.com without interruptions.  HELP

     

    Tuesday, March 25, 2008 8:05 PM
  • Follow the instructions in this post, http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=662566&SiteID=2, to report a virus that is not cleaned by OneCare and to get help in removal.

     

    If you are in North America, you can call 866-727-2338 for help with virus and spyware infections. See http://www.microsoft.com/protect/support/default.mspx  for details.  For international information, see your local subsidiary Support site.

    -steve

    Wednesday, March 26, 2008 1:52 AM
    Moderator