Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Removing consrv.dll virus


  • This topic is locked This topic is locked
4 replies to this topic

#1 Cyjon

Cyjon

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 30 August 2011 - 01:02 PM

My brother-in-law asked me to look at his computer because the McAfee firewall kept turning off. It's a Windows 7 system.

I scanned with McAfee, Spyware S&D and Malware Bytes, all fully updated, and they found nothing. I booted the Antivir rescue disk and it found three viruses. The first two were in C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup. The files were idko.exe and umaqe.exe and Antivir said they were both examples of TR/Obfuscate.QG.184. The third was C:\Windows\System32\consrv.dll and Antivir said it was the TR/ATRAPS.Gen2. It renamed all three files and I rebooted.

Windows wouldn't boot, even in safe mode. It would start and then reboot before it got very far. From my research, the problem was consrv.dll. There is apparently a registry entry which needs to be changed to point to winsrv.dll instead of consrv.dll to delete the virus cleanly.

I used BartPE to boot and rename the file back to consrv.dll. The system booted fine. I tried to make the registry change and it would immediately revert back. Since then I have also tried the Kapersky rescue disk, fully updated, and it doesn't even see the virus.

I have since deleted the two viruses in Startup with no harm. However if I do anything to consrv.dll, the system becomes unbootable. I have no idea what the next step would be, short of a complete reformat and reinstall.

To complicate matters, I have access to this computer only Mondays and Fridays during the time I'm taking care of their daughter, so it's hard to really focus on the problem.

BC AdBot (Login to Remove)

 


#2 zordon

zordon

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:08:44 PM

Posted 30 August 2011 - 01:29 PM

I seen this infection three times on my client's computers. It's really tricky. In my experience, whenever I deleted the consrv.dll and rebooted, it would force Windows to run a start up repair. To save a lot of hassle, the easiest way to get rid of this infection is to run a system restore to before the computer was infected. The three times I had to remove this virus, I knew exactly when the client was infected. All I did was run a system restore before that date and the computer was clean. I ran Malwarebytes and other scans to make sure everything was gone.

#3 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,679 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:09:44 PM

Posted 30 August 2011 - 07:42 PM

It looks like ZeroAccess rootkit.

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#4 Cyjon

Cyjon
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:44 PM

Posted 02 September 2011 - 04:42 PM

New thread at http://www.bleepingcomputer.com/forums/topic417190.html

Thanks for any help you can give. I'd rather not use system restore since I don't know how long he's been infected, so I'm hoping I can extricate the malware cleanly.

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,550 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:11:44 PM

Posted 02 September 2011 - 05:16 PM

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the logs you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on, the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Now that your log is posted and you are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Removal Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.

Louis




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users