Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Drive-by Virus Attack CONSRV.DLL


  • Please log in to reply
1 reply to this topic

#1 Krimms

Krimms

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:04 PM

Posted 10 November 2011 - 11:56 PM

Ok, so AVG just came up about 30 minutes ago after detecting these files : c:\windows\System32\consrv.dll, c:\user\Mescaline\AppData\Roaming\dwme.exe, c:\Users\MEscaline\AppData\Local\Temp\dwme.exe. It also showed a file called AV Security 2012V121 located in C:\Windows\SYSWOW64\ folder. In a flash I had the files sent to the Virus Vault, but decided to do a search and found this forum. There was a topic I ran into here:

http://www.bleepingcomputer.com/forums/topic400730.html/page__st__15__p__2271737#entry2271737

I also looked at this from Kaspersky:

http://www.securelist.com/en/blog/493/MAX_sets_its_sights_on_x64_platforms

And from what I read I DO NOT WANT TO RESTART my computer, because apparently the registry has been changed and won't let me boot even in Safemode. I am afraid to immediately do a system restore because I'm afraid it won't make it that far (it has to restart eventually). My system is Windows 7 Ultimate 64bit and I was using Firefox when the attack occured. My question is, what is my immediate action? I noticed in the Virus Vault I could "restore" the file, and possibly use the Kasperksy Virus Removal Tool to remove it because that was recommended as a good fix for this, but alas, my fear is great and I would like the advice from a forum of computer vets before I make any moves... thank you in advance for anyone who lends me a guiding light.

Here is a photo of the AVG History:
Posted Image

Edited by Orange Blossom, 11 November 2011 - 03:15 AM.
Moved to AII from Windows 7 ~ OB


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,735 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:01:04 PM

Posted 11 November 2011 - 12:26 PM

With the information you have provided I believe you will need help from the malware removal team.
Please make sure that you read the information about getting started first.
Then start a new thread HERE and include or required logs.
Including a link to this thread will be helpful.

Good luck and be patient. Help is on the way!

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users