CrazyBull Trojan !!!! HUH?

[[]D[][]V[][]D]

Hi all. need a lil help on this. im running windows 2000 and i recently did a scan for trojans using TrojanHunter and it found this.

Found possible trojan file: C:\Program Files\Creative\MediaSoure\RemoteControl\CTRemote.d ll (CrazyBull)

i have a Audigy 2 ex and this is apparently where its located.Now i did a virus scan with Norton anti-virus 2003 and it found nothing ( with latest updates). I also trawled there online database and found no ref to CrazyBull or w32/crazybull. However when you do a google search a few forign sites come up with this trojan.

Is it Hoax is it real or what?
Also below ive posted my scan from Hijckthis if someone could take a look id appreciate it.

Logfile of HijackThis v1.97.2
Scan saved at 02:09:57, on 27/09/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\WINNT\system32\CTsvcCDA.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINNT\system32\CTHELPER.EXE
C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\bobbydog\My Documents\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~2\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINNT\UpdReg.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [THGuard] C:\Program Files\TrojanHunter 3.6\THGuard.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe
O4 - HKCU\..\Run: [Steam] C:\Program Files\game\steam\Steam.exe -silent
O4 - Global Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37880.7379976852
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab



Thanks in advance for your time and help PIMP P.S also have Service Pk4 installed

[Budfred]

I can't tell you about your log, but I can tell you that Norton (and most antivirus programs) don't pay any attention to most trojans. If I understand it correctly, they don't consider a trojan to be a virus partly because you usually have to give some kind of permission to install the trojan. It may be quite hidden, but apparently it is there.

Hang on for a while and some of the experts will be along to tell you about the log....

[Mark Miller]

Off topic, but McaFee catches trojans all the time. I am using their online version [it's on my computer but without taking up the space]. Used it for awhile and they have caught and cleaned 3 or 4 of the nasties.
Mark:)

[Budfred]

Most will catch a few and I think that may have to do with how they are delivered, but it is not a good idea to rely on them for your virus protection. A firewall and careful downloading are probably the best protections, followed by regular scans....

[Galadriel]

Originally posted by []D[][]V[][]D
Hi all. need a lil help on this. im running windows 2000 and i recently did a scan for trojans using TrojanHunter and it found this.

Found possible trojan file: C:\Program Files\Creative\MediaSoure\RemoteControl\CTRemote.d ll (CrazyBull)


The important part is highlited above.... Are you scanning with heuristics ? If so, that raises the false positives rate. I think there is a setting to lower false positives.... check your settings in TH. I highly doubt that you have a trojan.

[[]D[][]V[][]D]

Just to reply to a few and to add a lil extra.with my fire wall i run with the heuristics as high as poss in both auto-protect and maual scans. i also keep my anti virus uptodate with with the inteligent updater. as for my firewall when im not using an application to access the net i usually block its access. only things that have constant access are things like firewall/anti-virus/msn messenger/ outlook/ie and netmeeting. in fact i just checked and thats the lot. ive also only just (about a week ago) reformated so everthing is prety much a clean install of drivers and such. and im very perticular about d/l from dodgy sites. i wasnt totally confinced i had a trojan but then i dont know everything and when i dont know i like to ask. so thanks again to all the peeps that have replyed so far and ill continue to check see if any more has been added.


Da Pimp