Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help me - sudden and **unknown** virus


  • Please log in to reply
14 replies to this topic

#1 cavalier1516

cavalier1516

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 27 February 2005 - 08:58 PM

Out of nowhere (you'll see why), I all of a sudden have a very tough and extremely rare (it seems) virus.


DISCOVERY OF THE VIRUS

Yesterday, I connected to the internet (I have dial-up), but my little connection icon didn't show up. I was, however connected to teh internet (although NOT to my homepage, it had been replaced with "about: blank" the name of the virus that is doing this is scpStelth.cih ver.2.018). This has happened before, in fact, I haven't seen the original "Connected" icon in over a year (so i can't see how good or bad of a connection I've got), I assume because of a virus. I recently bought a new modem (old one crapped out), and the new modem produced its own icon, so lately I've been able to tell. As I said though, this icon dissappeared too.

I ignored it, figuring I'd deal with it later, and attempted to run Star Wars Galaxies. This is why I have no idea where this virus came from. The only time I've been connected to the internet in the last month and a half is when I play Star Wars Galaxies. However, I kept getting a client error (again, I assume because of this virus), and couldn't log on.


APPLICATIONS I HAVE/USE

I keep my machine very clean, I have multiple adware, virus, cleaning and scanning programs (Antivir XP, Spybot Search and Destroy, Ad-Aware 6.0, Microsoft antispyware, Windows Washer 5, AVG Free, and Ad-Watch 3.0, HijackThis, fixbgbear).

None of these can remove this virus. I had two friends (who know what they're doing) try EVERYTHING they could think of to fix it, but they couldn't.


DETAILS ABOUT THE VIRUS

The virus shows up in the Task Manager as rpcss_pl.exe, but cannot be removed. It changes my IE homepage, hides or removes my connected icon, does not allow me to right click and "Open in a new window", and disables my keyboard anytime I try to play games i have installed. It probably does more that I haven't even found out yet. My friend found (I think by running one of my scanning programs) the name of the virus (I don't remember, and im runnning adaware, so it should show up in that, and then I'll try to post the name of it), Googled it, and only ONE result was found, and it was some German website. Also, it seems to attack HijackThis.


OTHER VIRUSES/SPYWARE I HAVE (AND ANY ADVICE ON REMOVING THEM AS WELL WILL BE APPRECIATED)

TR/Rameh (as it shows up on Antivir XP, in an archive, so it cannot be removed)
Heuristic/Java.Downloader (again, found by Antivir xp, in an archive, so it cannot be removed)
Huntbar (as it shows up in Spybot Search & Destroy, I know where it is in the registry but cannot delete it)





I'm not too computer literate, but I can handle my own fairly well, and if I have detailed instructions, I can manage. If you need to know anything else about this virus, i.e. where it shows up in regedit or something, lemme know how to look that up, and I will and will reply asap. Same with inquiries about my system.


All help is greatly appreciated.

Edited by cavalier1516, 28 February 2005 - 05:24 AM.


BC AdBot (Login to Remove)

 


m

#2 st0nedsk8er

st0nedsk8er

  • Members
  • 33 posts
  • OFFLINE
  •  
  • Local time:04:22 AM

Posted 27 February 2005 - 09:07 PM

perhaps you should run an anti-VIRUS program rather than a anti-spyware/adware program...adware and viruses are two different things..Here is an free online virus scan..works pretty good and should find it, but i reccomend you purchase a virus scanner such as Norton ..well here is the link http://housecall.trendmicro.com/housecall/start_corp.asp all you have to do is select your location and you're set..hope this helps

#3 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 27 February 2005 - 09:54 PM

Alright, I'll try that out, although im pretty sure a couple of those programs I listed scan for and remove viruses.


Also, the virus i have will not let me click on links like that (have to copy and paste or type it) , and has disable my windows search feature, and cause my internet to disconnect if left idle for more than a couple minutes.

Edited by cavalier1516, 27 February 2005 - 09:59 PM.


#4 TexasAngel67

TexasAngel67

    Bleeping Helper


  • Members
  • 1,551 posts
  • OFFLINE
  •  
  • Location:Fort Worth
  • Local time:04:22 AM

Posted 27 February 2005 - 10:19 PM

Let me suggest that you go to the link in my signature below. If there is a virus, threat, or other yuckie on your system, including any remnants of one, HijackThis will find it. See the link for details and the download. It's totally safe and free.
Post the log in the HijackThis Logs and Analysis forum. Our team of experts will view your log ASAP and guide you on any further instructions.
Thanks and good luck.
~67~

I see that you have the program, just be sure it's the latest version.
Sorry, I checked back and saw that you have HJT. Please post your
log in the appropriate forum. Posting it here will slow down the response
time.

#5 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 28 February 2005 - 12:51 AM

I have HijackThis v1.99.1, I believe that's the latest version. When I run it, I get an error, and it tells me "Your host file has invalid line breaks and HijackThis is unable to fix this. 01 items will not be displayed." then i click ok to finish the scan. I'll post my log and reference this thread in the HJT forum.


ALSO, my Windows Media Player has stopped working, and when I tried to use Sbybot S&D to delete some stuff it picked up, I got an error: "Fehler beim setzen der Daten fu 'SpyBotSnD'". Did I mention that the 1 site that appeared when my friends Googled this virus was a german website? This virus is dismatling my computer.





><

Edited by cavalier1516, 28 February 2005 - 01:24 AM.


#6 TexasAngel67

TexasAngel67

    Bleeping Helper


  • Members
  • 1,551 posts
  • OFFLINE
  •  
  • Location:Fort Worth
  • Local time:04:22 AM

Posted 28 February 2005 - 01:50 AM

It sounds like a yuckie thing has embedded itself in your system. I'm not an expert with the 2000 versions of Windows, including XP, but I'd bet that our team of experts will point you in the right direction with a HJT log.
Regarding the WMP issue, please check Windows Updates for your particular Operating System (WinXP or Win2000, etc...).
I'll keep an eye on this thread and the HJT forum with your log.
FYI - glad you have Spybot and HJT. Get Ad-aware also if you don't have it. And always be sure you check all of them for updates. :thumbsup:

#7 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 28 February 2005 - 02:20 AM

yeah, this virus is taking me down hardcore. its attacking my apps, its attacking my utilities, and - worst of all - its attacking my games! anyway, I have ad-aware; I listed most of the apps I use in my first post.

Yeah, I saw that this site has experts and I'm glad I stumbled on it. I posted my log, and hopefully they can help me out.

#8 TexasAngel67

TexasAngel67

    Bleeping Helper


  • Members
  • 1,551 posts
  • OFFLINE
  •  
  • Location:Fort Worth
  • Local time:04:22 AM

Posted 28 February 2005 - 02:49 AM

Hi Cavalier, I am so sorry that I keep posting before reviewing what you already have. I promise I'm not stupid, just blonde. Plus it's really late and I've not slept much at all the past couple of nights. Thanks for being understanding.

#9 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 28 February 2005 - 03:56 AM

perhaps you should run an anti-VIRUS program rather than a anti-spyware/adware program...adware and viruses are two different things..Here is an free online virus scan..works pretty good and should find it, but i reccomend you purchase a virus scanner such as Norton ..well here is the link http://housecall.trendmicro.com/housecall/start_corp.asp    all you have to do is select your location and you're set..hope this helps

because of the virus I couldn't use your link, but i got to that site and nothing loaded. so ui downloaded the trial version, and it's either being affected by the virus, or junk. I click scan and it just says "This feature is still initializing. Wait a few moments and try again later." I've waited for 56 "moments", and still wating.





texasangel, don't worry about it. ;) your replies are keeping my post near the top where it can be seen easier.

Edited by cavalier1516, 28 February 2005 - 03:58 AM.


#10 stidyup

stidyup

  • Members
  • 641 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:22 AM

Posted 28 February 2005 - 10:54 AM

Try downloading and running RescueME see my sig, it should allow you to download several different AV removal tools.

Once you've downloaded them, don't run from normal windows boot into safe mode, then run the utilities. Hit F8 when your PC boots up for the menu option to get into safe mode.

If your successful post a hijackthis log in this here to make sure your clean.

If you have access to a clean XP pc you might also consider building the ubcd4win which might give you better success.

#11 JEservices

JEservices

    helping hand


  • Members
  • 1,700 posts
  • OFFLINE
  •  
  • Location:Texas
  • Local time:02:22 AM

Posted 28 February 2005 - 04:06 PM

Have you tried the virus scanns in Safe Mode?
We are all curious like a cat. We wonder, we ask, we learn.
Please post back when a suggestion works, so that others may learn.

#12 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 01 March 2005 - 05:08 PM

ran all my scans in safe mode, found and deleted a few other viruses (AntiVir XP detects 3 viruses that the other scans do not, but it says they are in archives, and AntiVir XP doesn't delete viruses inn archives, so I can't delete them).

The Uber Virus raping my PC is there, though.








><

#13 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 01 March 2005 - 06:54 PM

I understand that no one can help me on this, because as I said, this virus is completely obscure and unknow.

By the way, it has attacked Window Washer 5 (which now crashes after I wash up). And scans no longer detect it, although it's still there.

It looks more and more likely that I'll be reformatting this weekend, assuming this virus even allows me to do that.










Deutschland vor allem.

#14 cavalier1516

cavalier1516
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:03:22 AM

Posted 02 March 2005 - 01:24 AM

someone help me out, my internet has slowed to a c r a w l.... I can barely manage to load these forums...

#15 stidyup

stidyup

  • Members
  • 641 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:22 AM

Posted 02 March 2005 - 03:07 AM

Run HijackThis save the log and post the log results in this section of the forum.

Somebody will analyse the log for you and tell you how to clean up your PC.

If you do have a unknown virus undected by most AV software vendors, can you submit a sample of the file to these vendors here. There are also links to 2 sites where you can scan the suspect file by several different AV vendors, it may give you another name to look which may allow you to find a clean up tool for this specific virus.

I'd also try the ubcd4win as your OS won't be loaded when this runs so none of your system files will be in use or locked. Or follow my instructions here and run fprot for dos with a ntfs4dos driver to access your files, here.

Edited by stidyup, 02 March 2005 - 03:25 AM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users