Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Generic 16.BVN


  • Please log in to reply
1 reply to this topic

#1 Rose4uKY

Rose4uKY

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:38 PM

Posted 04 January 2010 - 11:34 AM

Ok I need help please! My Nortons expired awhile back and last night something happened from a program or website I was on. I was trying to download a movie but anway I have windows vist 32 bit.. All of a sudden a windows security window popped up and said my firewall was off and it something about you have no Anti Virus detected on your computer and I may have clicked on install now I don't remember what I did but some malware defender or something installed and I uninstalled it.. I see this windows security icon in my taskbar and it won't let me exit it out. It keeps saying your computer has serious threats danger. I downloaded AVG.. I am having the peoblems as earlier posyers above. I keep getting this fake security center alert window poping up.. I keep getting all these different names. I am getting the back door one this Net-Worm.Win32.DipNet.d,Trojan.Win32Agent.doc,RootKit.Win32.Agent.pp,Win32.Hala.a and a couple other named ones. AVG found a threat and in the vault it says Trojan Horse Generic 16.BVN. It says it is in C/users/Owner/appdata/local/temp/installer.exe The security window popping up says unblock keep blocking which are greyed out and then enable protection. When I click on enable protection it says Threat found and the same generic 16.BVN keeps going to the vault and this is happening over and over but I keep getting this red circle with a white X that says Windows cannot acess the specified device,path, or file. You may not have the appropriate permission to acess them.. When I close out that error message the security window showing me the name of the trojan closed also and it adds and extra generic 16.BVN thing to my vault but the security window keeps popping up and showingme all these different trojans. If I don't click enable and just close it another opens shortly after. It also keeps putting these 3 porn icon shortcuts on my desktop and I was not at a porn site. I deleted them off my desktop and they come back.. I ran CC cleaner too and ran AVG... But I think this Windows cannot acess the specified device,path, or file. You may not have the appropriate permission to acess them has something to do with them keep showing up I am not sure..

Last night I unplugged my cable modem so I wouldn't be on the internet cause I read abotu stealing identies and credit card info and hacking into my pc and I got scared.. Should I go to the beginning of this thread and follow the instructions? This error message Windows cannot acess the specified device,path, or file. You may not have the appropriate permission to acess them to me might have something to do with it too I am not sure.. Can I go to this folder and delete something C/users/Owner/appdata/local/temp/installer.exe which is where it keeps saying the generic BVN is at? That name and folder is in my AVG vault over 20 times.. But yeah If I click enable then the threat AVG window pops up with that red circle and white X error message and if I click on on the error message the fake security window the name of the trojan goes away and another thingi s added to my vault the same thing and then another window pops right up again saying the same thing with a diff trojan name.. It's greyed out for me to block or keep blocking just enable is available for clicking.. Thanks and sorry I typed a long post but I am scared and really want this fixed. Have to go to work in a couple hours and will unplug my cable modem again. Thanks Rose

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,416 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:38 PM

Posted 04 January 2010 - 12:49 PM

Hello, I moved this here..
First some advice on this infection.

One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.


To start cleaning ,
Run RKill....

Please download Rkill by Grinler and save it to your desktop.Link 2
Link 3
Link 4
  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • If the tool does not run from any of the links provided, please let me know.
You will need to run the application again if rebooting the computer occurs along the way.

Next run MBAM (MalwareBytes):

NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop.

Please download Malwarebytes Anti-Malware and save it to your desktop.

alternate download link

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users