Approximately 15 minutes ago my anti virus software reported two trojans which I chose to delete immediately. But 3 to 4 minutes down the line these files would reappear, so it was being spawned somehow.
I checked my connection log and discovered a suspicious connection by explorer.exe to 207.126.115.245 (ninja.chatx.net) on port 3211
after blacklisting this ip address the respawning stopped.
so i was sure that this was the culprit, however I wanted to make sure, so i allowed the system to connect to it again.
what this connection actually does is initiate a new connection also through explorer.exe to 213.193.4.11 (members-tmm.vip.lycey.net) on default http port 80
this is where the two malicious files are downloaded from.
they are as follows:
asdsdsdss.exe
Mywife[1].exe
avast reports it as containing Win32:Trojan-gen {Other}
I checked my connection log and discovered a suspicious connection by explorer.exe to 207.126.115.245 (ninja.chatx.net) on port 3211
after blacklisting this ip address the respawning stopped.
so i was sure that this was the culprit, however I wanted to make sure, so i allowed the system to connect to it again.
what this connection actually does is initiate a new connection also through explorer.exe to 213.193.4.11 (members-tmm.vip.lycey.net) on default http port 80
this is where the two malicious files are downloaded from.
they are as follows:
asdsdsdss.exe
Mywife[1].exe
avast reports it as containing Win32:Trojan-gen {Other}
