Continual threat from on-access scanner - spy.goldun.nct

Discussion in 'ESET NOD32 Antivirus' started by dedex13, Apr 5, 2008.

Thread Status:
Not open for further replies.
  1. dedex13

    dedex13 Registered Member

    Joined:
    Apr 5, 2008
    Posts:
    1
    I installed ESET NOD32 about an hour and a half ago. Since then I've gotten 326 threats (and counting). This is what is says in the log file for all of them:

    4/5/2008 3:28:51 PM
    Real-time file system protection
    file
    C:\WINDOWS\system32\3709679781.CPX
    Win32/Spy.Goldun.NCT trojan
    cleaned by deleting - quarantined
    NT AUTHORITY\SYSTEM
    Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE.

    The notification box is just about driving me nuts popping up every 10 seconds or so.

    How do I get rid of this thing? In plain English please, since I know just enough about computers to be dangerous (and actually most of that knowledge is probably dated). I've done a search for spy.goldun.nct and got zero results.

    I'm in the process of running an on-demand scan.

    Thanks for any help you can give me.
     
  2. Bitten By C Bug

    Bitten By C Bug Registered Member

    Joined:
    May 9, 2007
    Posts:
    45
    Hello DeDe.. did some searching/reading and www.seguridaddigital.info/index.php?option=com_newsfeeds&task=view&feedid=25&Itemid=7 might help ya a little but looks and sounds to me like you need to find a forum that specializes in such and post hijack log or eset system inspector log which can be found
    http://www.eset.com/esibeta/... also superantispyware free edition could prove helpful as well... good luck.. Let Me know how it goes as sister in law had identical trojan 4 days ago i had to remove..
     
  3. SUPERAntiSpy

    SUPERAntiSpy Developer

    Joined:
    Mar 21, 2006
    Posts:
    1,088
    If SUPERAntiSpyware Free Edition doesn't fully remove it, submit a support request here and we will run our custom diagnostic on your system and update our definitions to remove the threat completely:
    http://www.superantispyware.com/support.html
     
  4. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    576
    HaxFix might be able to remove that. If not, I suggest you follow what Nick suggested.

    thanatos
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,411
    I've been under the impression that this is a NOD32 support forum and not a forum of SuperAntispyware or other tools. If your computer is infected, use ESET SysInspector. If you are unable to figure out the malware, send a log from ESI to support[at]eset.com.
     
  6. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    576
    I am sorry about that Marcos.

    thanatos
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.