Showing posts with label Trojan. Show all posts
Showing posts with label Trojan. Show all posts

Tuesday, September 21, 2021

taskhost.exe what is ? camera access / internet access firewall blocked

 Today i faced the problem:

firewall blocked internet access for taskhostw.exe 

I tried to investigate what is it and why it wants internet access. 

After searching found some posts for asking same problem , but differently their exe tried to access camera, which triggered them to search for possible problem too.

In result i scanned pc with different malware cleaners with fixes as original dell autostarters and no other trojans as monero miners and so on..

I checked IP which was triggered to internet access - 51.104.136.2 . After checking 'IP 51.104.136.2' , it turns out it is microsoft azure servers.



For now i agreed to allow internet access, but turned off frequence to diagnostics to report in windows settings to "never"  

Thursday, July 5, 2012

OpenX remove Trojan program HEUR:Trojan.Script.Iframer



So for last few days i was faced with the Trojan which was injected into OpenX.

So here is my guide how to remove it.

1. First of all create
`banners` copy like `banners_2` ( so it be backup if you will need it ).

2. Lanch the query to remove unwanted virus / trojan code snippets

UPDATE `banners` SET `htmltemplate` = '', `htmlcache` = '', `append` = ''
WHERE 1
AND
(
`htmltemplate` LIKE '%BrowserDetect%' OR `htmltemplate` LIKE '%function hex2a(hex)%' OR`htmlcache` LIKE '%BrowserDetect%' OR ` htmlcache ` LIKE '%function hex2a(hex)%' OR`append` LIKE '%BrowserDetect%' OR ` append ` LIKE '%function hex2a(hex)%')

[EDIT]
Launch same query for zones table
UPDATE `zones` SET `append` = ''
WHERE 1
AND
(
`append` LIKE '%BrowserDetect%' OR ` append ` LIKE '%function hex2a(hex)%')

[EDIT end]

3. Do OpenX update to latest version ( 2.8.9 for current moment )

4. After you update your OpenX, lanch query at (2) for one more time.

5. At this stage you will need to clear cache or just wait to renew it by itself.. I didnt deleted it, so i cant tell you anything about how to do it. If you OpenX is huge i dont recommend you to delete it., better ask someone who knows anything about "grep" ( Google scan command? ).
Cache exists in var/cache/

[EDIT]
6. After all this cleanings we still couldn't find the trojan by itself, but banners and zones position were infected from time to time...
Solution for this was to limit`append` field attribute length to '10' symbols. It helped us for now...
[EDIT end]

These are steps which we took and a bit more..

Hope it will help you. Good luck, you will need it.

p.s. a bit more information can be fount here:
http://www.openxconsultant.com/blog/2011/10/what-to-do-when-you-suspect-your-openx-system-has-been-hacked/