Continual threat from on-access scanner - spy.goldun.nct

Discussion in 'ESET NOD32 Antivirus' started by dedex13, Apr 5, 2008.

Thread Status:
Not open for further replies.
  1. dedex13

    dedex13 Registered Member

    Joined:
    Apr 5, 2008
    Posts:
    1
    I installed ESET NOD32 about an hour and a half ago. Since then I've gotten 326 threats (and counting). This is what is says in the log file for all of them:

    4/5/2008 3:28:51 PM
    Real-time file system protection
    file
    C:\WINDOWS\system32\3709679781.CPX
    Win32/Spy.Goldun.NCT trojan
    cleaned by deleting - quarantined
    NT AUTHORITY\SYSTEM
    Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE.

    The notification box is just about driving me nuts popping up every 10 seconds or so.

    How do I get rid of this thing? In plain English please, since I know just enough about computers to be dangerous (and actually most of that knowledge is probably dated). I've done a search for spy.goldun.nct and got zero results.

    I'm in the process of running an on-demand scan.

    Thanks for any help you can give me.
     
  2. Bitten By C Bug

    Bitten By C Bug Registered Member

    Joined:
    May 9, 2007
    Posts:
    45
    Hello DeDe.. did some searching/reading and www.seguridaddigital.info/index.php?option=com_newsfeeds&task=view&feedid=25&Itemid=7 might help ya a little but looks and sounds to me like you need to find a forum that specializes in such and post hijack log or eset system inspector log which can be found
    http://www.eset.com/esibeta/... also superantispyware free edition could prove helpful as well... good luck.. Let Me know how it goes as sister in law had identical trojan 4 days ago i had to remove..
     
  3. SUPERAntiSpy

    SUPERAntiSpy Developer

    Joined:
    Mar 21, 2006
    Posts:
    1,088
    If SUPERAntiSpyware Free Edition doesn't fully remove it, submit a support request here and we will run our custom diagnostic on your system and update our definitions to remove the threat completely:
    http://www.superantispyware.com/support.html
     
  4. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    HaxFix might be able to remove that. If not, I suggest you follow what Nick suggested.

    thanatos
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    I've been under the impression that this is a NOD32 support forum and not a forum of SuperAntispyware or other tools. If your computer is infected, use ESET SysInspector. If you are unable to figure out the malware, send a log from ESI to support[at]eset.com.
     
  6. thanatos_theos

    thanatos_theos Registered Member

    Joined:
    Apr 28, 2007
    Posts:
    540
    I am sorry about that Marcos.

    thanatos
     
Thread Status:
Not open for further replies.