Nod Captured A Trojan Today

I've been trialing Nod32 for about 20 days. I always practice safe computing. However, I wanted to take Nod to the darkside of the web...Just to see if I could catch a trojan,or virus, or malware After all, I'm thinking pretty seriously about purchasing nod..So I wanted to see nod in action in the real world. Not on a test.

So we start our journey..Armed with Nod32 and Boclean. Okay bad boys...come out where ever you are It didn't take long to find one. I entered a website. Then proceeded to click on a link. That's all it took, just one link. I got lucky..didn't even have to click on a second link. See screenshot.

The full name of the trojan is: JS/TrojanDownloader.lstBAR.A trojan I couldn't find any information on this trojan by googling it. However, It tries to install a toolbar on Internet Explorer. I was running mozilla firefox. After quarantining the trojan.. I see a sign that says.....For IE users only.

 

ronjor, agree with you 100%.

Just last night, my son went to surf some kiddy game website, and IMON detected TrojanDownloader.Rameh.C trojan in a cab file from what appears to be right on the website's home page. Since I have two kids, and they both are very aware of the dangers of surfing, I have IMON set to automatically terminate the connection, so there were no files saved, and there was nothing to clean.

 

Imagine that...another hit out of the park for NOD

 

Have you read through Extra Settings for Nod32 in regards to Esets use of the word "Quarantine". That thread also show you how to tweak up Nod32 to the maximum.

Hope this helps...

Cheers

 

Hi Blackspear. Yes, I have nod tweaked just like your tutorial says. When nod caught the trojan. I just checked quaratine box and terminated the connection

 

That's good, just wanted to check

And you do understand that Quarantine only makes an encrypted "copy" of the infection, it does NOT isolate the file.

Cheers

 

After Googling the file to see what this trojan does. I couldn't find any info, so I deleted the file. I rebooted and ran a virus scan ..just to be sure it was gone. The scan came up clean. No infections found. I also ran adaware and spybot and they found nothing. No I didn't know that it didn't isolate the file

 

That's what I thought, and also wanted to make sure that you did understand this. I have highlighted the fact several times in Extra Settings for Nod32, but being human we all tend to fly past something at some point in time

Cheers

 

Thanks for the info Blackspear. I think I had better go back through the tutorial again. Just to be sure

 

You guys are so right. I just checked the CyberTech Help Forum and got a trojan on the first page. IMON terminated him and after running a scan I am clean. However, one question, is there any way to remove instance of trojan in IMON without rebooting?

 

I have a question. I've got nod set up to clean first, if cleaning isn't possible then to quaratine. When imon detects a virus..see screenshot...Do I just click the "Terminate & Disconnect, or must I put a checkmark inside the quaratine box? And then click "terminate & Disconnect?

 

Thanks for replying ronjor. I've read through Blackspears tutorial twice. This was the only thing that was confusing to me. I had previously been putting a check mark in the quarantine box, and then terminating the connection. Thanks for clearing this up for me . Thanks for the link to the faq on esets homepage. I haven't saw those before.

 

Actually the trojan I thought I had gotten at Cyber Tech Help forums was a false positive. I had just installed adblock (an extension) in Firefox and it caused a false positive every time I visited that forum. Since uninstalling adblock I no longer get the trojan.

 

If the HTTP scanner in IMON detects a probable unknown virus via heuristics, the Copy to quarantine button (named Quarantine in the current version) is already ticked automatically.

 

Very nice Marcos, thanks for this information...

Cheers