Author Topic: Need help with a torrent related trojan :( (Read 2083 times)

Smiffe · « **on:** August 03, 2010, 09:17:01 AM »

Hello everybody!

I really need help to fix this trojan.. my NOD32 says it's "a variant of WMA/trojanDownloader.getcodec.gen trojan" in any video torrent file i download from any torrent site :'(
Ive tried Spywaredoctor, maleware anti-malware program, using google to find where other people have gotten rid of the same trojan...

But non has helped since it isn't the same trojan as everyone else has

Mine doesn't infect files I already have downloaded, it doesn't infect MP3 files as seem to be the biggest problem with this trojan. $:-\$

It might be a conflicer trojan/virus of some sort but I can't find how to get rid of it >_<

please help

cyphir · « **Reply #1 on:** August 03, 2010, 10:14:14 AM »

Icky. You're downloading WMA and WMV files probably. Those are usually riddled with spyware and other nasties. The trojan you're refering to is that when you download the file, when opening it up the player (usually wmp) will say you cannot play the file unless you go to a site to download the proper "codecs". Which is just a scam.

I highly doubt there is proper audio/video in the file you downloaded in the first place.

Download a proper format. Usually there are .avi, .mkv and .mp4 for video and .mp3 or .flaac or .ogg for audio.

Freedom Kira · « **Reply #2 on:** August 03, 2010, 11:37:14 AM »

When you say:

Quote from: Smiffe on August 03, 2010, 09:17:01 AM

my NOD32 says it's "a variant of WMA/trojanDownloader.getcodec.gen trojan" in any video torrent file i download from any torrent site

Do you mean the different torrent files that you download from different torrent sites are the same? i.e. you are trying to get fansub group X's files from sites A, B, or C, and all of them give you the same trojan?

Or do you mean you're downloading fansub group X's files from site A, and group Y's files from site B, and group Z's files from site C, and all of them give you the same trojan, and all the files are of different formats, which may or may not include WMV/WMA?

Smiffe · « **Reply #3 on:** August 03, 2010, 12:05:26 PM »

Actually i tried to download a MKV file from a torrent tracker ive never seen before, but oh well :/

I get the problem even from BakaBT when I try to download from here.. MP3 files are no problem, but MKV files get infected after a few seconds in uTorrent.. (uninstalled, scanned, rebooted, reinstalled.. still same problem) And I try to play with VLC so I don't click those stupid lies on Windows Media Player about codecs.....

The file I tried to download was a Wma file, I ran the file, it didn't work.. then i deleted it and now all my downloads don't work (mkv, wma, avi)

Blanchimont · « **Reply #4 on:** August 03, 2010, 12:32:03 PM »

Get this and run it on few of the files (with crc included in the name).

If they pass, it's NOD32 that's wrong. ...But if the result doesn't match the crc in the filename, then you probably have something bad...

Al_Sleeper · « **Reply #5 on:** August 03, 2010, 12:34:32 PM »

IIRC, it's fairly common for NOD32 to give false positive results

.
KAV is a bit better in that respect.

Smiffe · « **Reply #6 on:** August 03, 2010, 12:59:20 PM »

Quote from: Blanchimont on August 03, 2010, 12:32:03 PM

Get this and run it on few of the files (with crc included in the name).

If they pass, it's NOD32 that's wrong. ...But if the result doesn't match the crc in the filename, then you probably have something bad...

It's not Sfv files or anything that is the problem. It works like this:

I click download any file on BakaBT
it goes into uTorrent and it starts to download. THEN after like 20-30 seconds Nod32 says the file is infected by that Trojan and deletes it :/

Al_Sleeper: What is KAV then? Kaspersky?

Al_Sleeper · « **Reply #7 on:** August 03, 2010, 01:19:15 PM »

Quote from: Smiffe on August 03, 2010, 12:59:20 PM

What is KAV then? Kaspersky?

Yes.

Smiffe · « **Reply #8 on:** August 03, 2010, 03:21:58 PM »

KAV doesn't find anything either

I just tried to download a game (legit game from gamesite) via torrent.. that file got infected aswell

Al_Sleeper · « **Reply #9 on:** August 03, 2010, 03:29:27 PM »

Then try to download a picture. If it gets "infected" as well, uninstall NOD32 and forget about that crap.

hanayome · « **Reply #10 on:** August 03, 2010, 03:30:25 PM »

KAV = Kaspersky Anti Virus

Just get rid of NOD32. BBT doesn't have any torrent with virus in it. I am 101% sure. Try uninstalling NOD and get Norton. Or Malwarebytes' to remove the virus(es) first.

@Blanchimont - which is better? animechecker or rapid crc?

Smiffe · « **Reply #11 on:** August 03, 2010, 03:55:17 PM »

It's not that the antivirus isn't working correctly. it's that it can't find the actual thing causing errors with torrent downloads

KAV installed and didn't help either... (uninstalled NOD32, restarted (without internet plugged in), installed KAV, plugged in internet, updating KAV. still same problem ._.

And pictures, MP3's don't get infected... it's not BBT that's giving me trojan, it was another site. but the crap I got infects torrent downloads :/

Malwarebyte didn't help either

And HKSFV is nice for checking files

hanayome · « **Reply #12 on:** August 03, 2010, 09:09:54 PM »

Simple solution : Format your PC.

Smiffe · « **Reply #13 on:** August 03, 2010, 09:14:55 PM »

That's to give up.. And what if I get the same trojan again? Keep formatting? >_>

Freedom Kira · « **Reply #14 on:** August 03, 2010, 09:58:42 PM »

Quote from: Smiffe on August 03, 2010, 09:14:55 PM

That's to give up.. And what if I get the same trojan again? Keep formatting? >_>

Well, formatting will improve your computer's performance in addition to removing baddies, as it resets the registry. So it's not necessarily to give up.

But of course, you will lose all your data except for MP3s and images, but there is the risk of the trojan hitching a ride on whatever USB device you plug in.

Anyway, point is, it's not giving up, it's the last-resort solution. One that you should definitely take if you've spent too much time on it.

Smiffe · « **Reply #15 on:** August 03, 2010, 10:51:29 PM »

Quote from: Freedom Kira on August 03, 2010, 09:58:42 PM

Well, formatting will improve your computer's performance in addition to removing baddies, as it resets the registry. So it's not necessarily to give up.

But of course, you will lose all your data except for MP3s and images, but there is the risk of the trojan hitching a ride on whatever USB device you plug in.

Anyway, point is, it's not giving up, it's the last-resort solution. One that you should definitely take if you've spent too much time on it.

Actually it's a lie that your computer improves in speed when you format your PC.. Regcleaner Expert does the same thing cleaning the registry as it where brand new..
ALL the trojan does is being realllly anoying when I try to download AVI, MKV, WMA files :/

Tho I want it gone! :O

Freedom Kira · « **Reply #16 on:** August 04, 2010, 02:06:54 AM »

Quote from: Smiffe on August 03, 2010, 10:51:29 PM

Actually it's a lie that your computer improves in speed when you format your PC.. Regcleaner Expert does the same thing cleaning the registry as it where brand new..
ALL the trojan does is being realllly anoying when I try to download AVI, MKV, WMA files :/

Tho I want it gone! :O

I've never really trusted those cleaner programs... but anyway, it's not a lie, a fresh install of any Windows OS moves faster than it does when it's been used regularly for over a year. Whether or not a registry cleaner does the same thing is irrelevant.

Smiffe · « **Reply #17 on:** August 04, 2010, 11:07:28 AM »

I never trusted them either.. But Last time I got a nasty error in my registry I tried one and it actually fixed aLOT of problems I had with old crap lying around

But it still don't clean our Trojans lurking around

Freedom Kira · « **Reply #18 on:** August 04, 2010, 11:20:04 AM »

Yeah, it doesn't, but a reformat does. This feels very circular.

hanayome · « **Reply #19 on:** August 04, 2010, 03:26:16 PM »

I never trusted those programs either. Try formatting only your windows drive. If it fixes the problem, you are lucky because you can retain all the data you have on the other drives. But if it doesn't go even after that, format your whole pc. That will definitely get rid of it. If you have any external storage devices (flash, external hdd, etc), connect it to another pc before your own. If it has a virus, format it as well, then connect it to your pc. Or, like i said, get Norton 360 for "cheap". I can PM you a link if you need.