Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help i have no idea what to do~!!!!


  • Please log in to reply
1 reply to this topic

#1 Anderw500GT

Anderw500GT

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:09:40 AM

Posted 31 July 2010 - 12:31 PM

i did a virus scan last night with kaspersky Anti-virus 2010...

well when i got up this morning i got a bad surprise...

it had detected 24 threats.. and they are all the same name.. and it looks like they are all in my systems files which is prolly going to make it harder to remove without crashing my computer.. the odd thing is idk what this thing does my computer seems to work just fine..

BUT! this may explain the Blue screen of death ive been getting a lot lately... you know when your computer screen just goes blue and it says something bout protecting your computer or something.... and you can't do anthing besides restart you computer....

well anyways how do i get rid of it? with out freaking paying best buy $200 to do it .. (i don't have that kind of money atm, even if i did that is way to much $$ for removing a virus when i doubt its really that hard...

ok so my computer has windows xp and i use Firefox for my browser and i use kspersky anti virus 2010 for my virus protection

and here is the list kaspersky gave me from the scan... (any help would be GREAT! also some info on what this thing does would be nice.. if the way to fix this is by downloading another program please give me very specific details on how to download and use that program.. im ok with computers but get very impatient with them and sometimes confused when its something i haven't done before... )

also even with this crap on my computer is it still safe to play Starcraft 2 online?

THANKS



7/31/2010 3:26:14 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP508\A0166798.dll
7/31/2010 3:26:56 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP510\A0167798.dll
7/31/2010 3:26:57 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP510\A0168798.dll
7/31/2010 3:27:29 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP510\A0169798.dll
7/31/2010 3:27:30 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP510\A0171798.dll
7/31/2010 3:27:31 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP511\A0171809.dll
7/31/2010 3:27:31 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP511\A0171810.dll
7/31/2010 3:27:32 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP511\A0171828.dll
7/31/2010 3:27:33 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP511\A0171829.dll
7/31/2010 3:27:33 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP511\A0171832.dll
7/31/2010 3:27:37 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP511\A0171895.dll
7/31/2010 3:27:44 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP512\A0171981.dll
7/31/2010 3:27:47 AM Detected: Backdoor.Win32.TDSS.vf C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP512\A0172977.exe
7/31/2010 4:24:45 AM Detected: Backdoor.Win32.TDSS.vf C:\Documents and Settings\Other.D9R1R881.000\Application Data\c170ff82.exe
7/31/2010 8:16:48 AM Detected: Backdoor.Win32.TDSS.vf C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP530\A0182668.exe
7/31/2010 8:51:03 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\ernel32.dll
7/31/2010 9:06:09 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\17w3uO.dll
7/31/2010 9:06:09 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\1yWS17.dll
7/31/2010 9:06:10 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\317kUO7o.dll
7/31/2010 9:06:28 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\E55kU.dll
7/31/2010 9:06:28 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\GMYWS9e.dll
7/31/2010 9:06:28 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\k5yWS.dll
7/31/2010 9:06:29 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\KU31i93.dll
7/31/2010 9:06:30 AM Detected: Backdoor.Win32.TDSS.vr C:\WINDOWS\system32\spool\prtprocs\w32x86\mYW931g9.dll

Moved from AII to MRL per Starbuck smile.gif ~ Hamluis.

Edited by hamluis, 31 July 2010 - 03:23 PM.
Moved from XP forum to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 


#2 Starbuck

Starbuck

    'r Brudiwr


  • Malware Response Team
  • 4,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Midlands, UK
  • Local time:02:40 PM

Posted 31 July 2010 - 03:18 PM

Hi Anderw500GT and welcome to Bleeping Computer.

QUOTE
and it looks like they are all in my systems files
if you mean this:
7/31/2010 3:26:14 AM Detected: Backdoor.Win32.TDSS.vr C:\System Volume Information\_restore{3DBD88D2-9FFC-498B-A689-A4771362F918}\RP508\A0166798.dll
These are the system restore points, as long as you don't use system restore until we have finished.... you'll be ok.

QUOTE
well anyways how do i get rid of it? with out freaking paying best buy $200 to do it .
I'm sure we can do this free of charge for you. smile.gif

I'm going to get one of the 'mods' to move this thread to the malware removal forum.
We can work on it better there.

While we are waiting, please do the following:
  • Download OTL to your desktop.
    right click on the link and select 'Save Link/Target As'.

    if you have problems, try this download link:
    OTL
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check
.

.
    Now copy the lines in bold below.

    netsvcs
    msconfig
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    CREATERESTOREPOINT


  • right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.


    .
  • Click the Run Scan button.


  • Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them with your next reply.

In your next reply, please submit:
Both reports from OTL.


Thanks.

BBPP6nz.png





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users