Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Mdelk.exe / Worm_bagle.ko


  • Please log in to reply
1 reply to this topic

#1 duhhan

duhhan

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:08:12 PM

Posted 26 February 2008 - 08:18 PM

I had norton anti-virus software installed on my computer, i was sending some emails and disabled it for a while, this was my biggest regret after my friend send me a program to send mails, and when i click on this file it says "select a file to crack" and nothing happens, after this my anti-virus program was not working anymore and i couldn't install any anti-virus program at all! I also can't start my computer in safe mode, when I select to start it in safe mode, after 10 seconds from loading the files on the screen it simply reboots.

So My only chance was an online webscanner (trendmico housecall), that did found the following:

Worm_Bagle.ko (c:\windows\system32\mdelk.exe) was infected
troj_generic
troj_proxydis.A
win32\dnet trzdnet.drop trojan.win32.disntnet6656
(c:\windows\system32\iosdt\iosdt.com) (was infected)

most were cleared BUT the mdelk.exe still can't be removed! it keeps installing itself. I managed to remove it for a while with the AD-AWARE since it gave me the option to remove it after reboot. But immediately after it was removed and the windows xp media centre started again, a window saying "select file to crack" was loaded again, then i relised from where the infection came from and deleted this program (as described earlier in the beginning of the problem)

until now i have these two files that contain mdelk:

C:\Windows\Prefetch\MDELK.EXE-0EF461CE.pf
C:\Windows\System32\mdelk.exe (the icon of the mdelk.exe file is like a bunch of 3 keys)

Can anyone please help me on how to kill this process from being born again?

thankyou

Edited by duhhan, 26 February 2008 - 08:30 PM.


BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,847 posts
  • ONLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:03:12 PM

Posted 28 February 2008 - 05:26 PM

Hello duhhan and welcome to BC :flowers:

Can you tell us the name of the "program" your friend sent you?

What is your operating system: Windows XP, Vista, etc.?

Do you have any other security programs installed?

If so, what are they?

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users