Hi all,

I'm wondering if somebody can help me with this problem?

For the last couple of weeks, when starting up the computer, when the desktop appears, a textbox appears in the middle of the screen saying:

Ibm 00003 has caused an error in
IBM 00003.DLL.
Ibm 00003 will now close

Beneath this there is a box saying 'close' which you have to click on and then it disappears.

Everything is functional, apart from a few problems I've noticed.

When on the internet it can take absolutely ages to open a page, and sometimes, trying to close a page is even worse, that's if it will close at all and you don't have to restart.

I've also noticed that on forums, on the log in, even if you tick the box for 'remember me next time', it totally disregards this, and you always have to go through the logging in process anyway.

Another thing I've noticed, is that when uploading an image, no matter what size you select for it, it will only come up in one size, the largest, regardless of the size you have selected.

What is the nature of this problem, and how can I sort it out?

Many thanks.

Draco.

Google is your friend:

IBM00003.DLL (no space):

Trojan keylogger

We've heard that a million monkeys at a million keyboards could produce the complete works of Shakespeare; now, thanks to the Internet, we know that is not true

Report Offensive Follow Up For Removal

Update your AV and run . Also run spybot and or adaware . If this fails try one of the free online scans also . Description from a AV site.

This section is for technical experts who want to know more.

Troj/Torpig-G is an information stealing Trojan for the Windows platform.

When Troj/Torpig-G is run some or all of the following files are created either in the folder C:\Program Files\Common Files\Microsoft Shared\Web Folders or in the folder <Windows system folder>\..\temp:

ibm00003.dll
ibm00001.exe
ibm00004.dll
<random>.tmp

The file ibm00001.exe is detected is Troj/Torpig-D. The file <random>.tmp is a clean data file. All other files are detected as Troj/Torpig-G.

The following registry entry is created to run ibm00001.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Shell
<path to ibm00001.exe>

The following registry entry may be created to run ibm00001.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
explorer.exe "<path to ibm00001.exe>"

An entry may be added to the file SYSTEM.INI in the "boot" section with a key name of "shell" to attempt to run ibm00001.exe on startup.

The Trojan attempts to steal passwords, as well as logging keypresses and open window titles to text files and periodically sends the collected information to a remote user via HTTP.

Troj/Torpig-G automatically closes security warning messages displayed by common anti-virus and security related applications.