Possible Trojan?

ISP says computer probing the net

[Mardi_Gras]

A friend called last night to say he had been called by his cable modm company and told that his computer was attempting to hack others, and if he didn't stop immediately they would ban him for life. Of course, they offered no advice or support other than suggesting he re-format his hard drive.

I ran Pest Patrol which came up with lots of cookies and Kazaa - no other .exe files. I know Kazaa does a lot of scummy stuff, but could this be the culprit? This sounds more trojan-like.

After installing Zone Alarm, the first program to try to access the Internet was "Generic Host Processor" which claimed to be from Microsoft. Although the name sounds suspicious, when we banned it from the Internet IE couldn't access the Internet either, so I am guessing (perhaps wrongly) that it is a legitimate part of Windows XP.

Any thoughts? Eradication strategies? What should I be searching for? Is Zone ALarm likely to stop any trojan from making outbound connections?

Any feedback is appreciated.

[oilman]

Pest Control is pretty good but have you run Norton or Mcaffee on the box to see if it finds anything?

[Mardi_Gras]

He said he ran a full Norton scan prior to my taking a look at the computer. It is a good point, though - I want to make certain he has a fresh set of virus defs and then I will re-scan.

[celerityfm]

Good call on making sure he has latest virus definitions and performing another scan.

Besides checking the program with Pest Control and McAfee, also scan it with these programs:

Spybot Search And Destroy
[security.kolla.de...]

AdAware
[lavasoftusa.com...]

One of these could pickup something that could be causing the problems your friend is experiencing...

[Mardi_Gras]

Thanks, celerityfm. I actually did run AdAware - just forgot to mention it. It found a few ill-tempered cookies, but Pest Patrol rooted out a lot more. I will try your other recommendation as well.

[lorax]

If his virus defs are out of date and he's contracted one it is quite possible that updating the defs and then scanning will yield nothing. Best to run the scan from a clean boot and original CD of the AV program.

[Rhys]

This is a related (I hope) query.

Background: My inbox got "bombed" with over 5000 "undeliverable" returned e-mails, which I believe were generated by some hacker using my (insecure) form-mail program as a relay for spam. I installed a new secure cgi form-mail and the e-mails stopped, but I got three or more nasties into my computer network as a side effect of this.
After re-installing Windows; using AVG and PCillin House Call I have found and cleaned (3 of) them, but have these unexplained problems still:

1. My computer goes online by itself at odd intervals and I can hear lots of traffic on the modem, but can't find any programs running with SystemInformation/ProgramsRunning or AdAware.

2. My CDWriter starts (again at odd intervals) frantic Read/Write activity and the computer is all but frozen - usually have to restart to get working again. (There is no problem if I temporarily replace it with a plain CDROM).

3. My Satellite net download card freezes whenever a download is initiated.

Does anyone know of a virus type 'infection' that behaves like this? :)

[lorax]

Rhys,
Yup, sounds like you have a trojan dialer. Visit the Symantec US website and do a search for 'modem' and 'dialer' and you'll get a list of trojans that it might be.

[symantec.com...]

The reason you don't see it is because it's not running a registered program or service. It's in hiding. Try booting up your computer in safe-mode and see if your computer still does wierd things. If not, then you can be sure it is a service that your computer is loading unbeknownst to you. But I'm pretty sure it is just by what you've described. Good luck.