Weird Virus and err stuff

iwantmore · TweakNOOB Joined: 09 Sep 2006 Posts: 4

One of my PCs on my network was constantly sending and receiving to the internet. I checkem my router log and saw that it was scanning ip ranges on port 445.

I unplugged it from the net and (using another PC) googled the port. Info I saw suggested a worm so I ran Trojan Hunter and found what it called a CIA.133
I think I have removed it, but I suspect that there will be more on there. I'm running Trojan Hunter again, followed by norton, Spybot and Adaware. (I'm a paranoid person!)

I checked online for details of the virus and there is nothing. Nothing on google, nothing on symantec!

Anyone know anything about this virus?

Google · Sponsor

sickofsoyo · Posted: Sat Sep 09, 2006 10:35 pm Post subject:

I dont know anything about it, but I would try some ad-aware scans, and also, make sure you boot into Safe mode to do virus removal, you may also want to try a scan with AVG free...
_________________
P4 3.2ghz
lanparty pro875b
Enermax Liberty 500 Watt Modular PSU
Sony 52X CD-RW
Samsung 120gig SATA hdd
Maxtor 100gig SATA hdd
Powmax Demon case
ATI X800 XL AIW, 525 Core, 525 mem
Creative X-Fi Platinum
PDP systems Patriot Ram 2,3,2,5 timings

sickofsoyo · Posted: Sat Sep 09, 2006 10:44 pm Post subject:

oh... also, do you have a firewall on that system? maybe you should invest on a hardwire firewall... more secure
_________________
P4 3.2ghz
lanparty pro875b
Enermax Liberty 500 Watt Modular PSU
Sony 52X CD-RW
Samsung 120gig SATA hdd
Maxtor 100gig SATA hdd
Powmax Demon case
ATI X800 XL AIW, 525 Core, 525 mem
Creative X-Fi Platinum
PDP systems Patriot Ram 2,3,2,5 timings

iwantmore · TweakNOOB Joined: 09 Sep 2006 Posts: 4

Yea, I've got a firewall on all pc's as well as the one fitted in the router. Can't understand how it got in.

Seems I have removed it. Was running in task manager as Winiogon
Its made to look like winlogon, but isnt.

Just thought that CIA.133 was a weird name, especially weird that symantec doesnt have anything.

I prefer Trojan Hunter to AVG any day. I used to use AVG but it kept givving "A bad thing happened" error messages and i wanted something that was more specific.

To resolve the matter I had blocked port 445 which seemed to work before I removed the worm or whatever it was.

Anyone know a good site for looking up known viruses?

sickofsoyo · Posted: Sun Sep 10, 2006 8:05 am Post subject:

check in the virus section (nate thats where this should be) there is a topic all the links to blady blah blah that should have enough sites. 1 of em should have it...
_________________
P4 3.2ghz
lanparty pro875b
Enermax Liberty 500 Watt Modular PSU
Sony 52X CD-RW
Samsung 120gig SATA hdd
Maxtor 100gig SATA hdd
Powmax Demon case
ATI X800 XL AIW, 525 Core, 525 mem
Creative X-Fi Platinum
PDP systems Patriot Ram 2,3,2,5 timings

iwantmore · TweakNOOB Joined: 09 Sep 2006 Posts: 4

There's a virus section on here? I checked before posting, but i couldnt find it.
If you can post a lik to it that'd be great.

many thanks

Xal · Posted: Tue Sep 12, 2006 10:00 am Post subject:

http://www.tweaknews.net/forum/viewforum.php?f=38

There ya go.
_________________
Phenom II x4 955 @ Stock
Asus M3N78-EM
4gb Corsair XMS2 DDR2 667 @ 800
1gb Powercolor Radeon HD 5850 @ Stock
X-fi Extreme Audio PCI E
Nexus 600W Silent PSU
Nexus Fans
Custom case

ToggleHead · TWEAKGURU Joined: 03 Mar 2004 Posts: 4360 Location: Jersey

Ill move it...=]
_________________