Anyone able to assist, please - prob virus.

miker1 · 14 May 2013 at 18:30

Sorry to bother you guys, but as from this morning I am unable to d/l stuff.

I finishes the download and comes up with the message [in red];
"filename" contained a virus and was deleted. [sometimes this is preceded by a message saying "scanning file"

I am assuming it is a virus as MSE has ceased to exist [by path] - if I run the exe from within the program files location it comes back with a message "the specified path does not exist" ! The malwarebytes icon has gone and I when run from the executable it finishes really fast saying no errors.

I haven't rolled back to a previous date yet, but I have used a couple of online scanners like "Bitdefender" which say there are no problems.

Anyone?
[Windows 7 64bit fully patched, IE10]

Mike

davestar_delux · 14 May 2013 at 18:38

Do you have another PC you can use to download some tools and stick them on a CD?

Any other symptoms? If you look in task manager do you see anything unusual running? Can you shut a few things down you shouldn't need and see if it allows you or they start up again? Also go start > run and type msconfig. Go to the startup tab and see if anything dodgy in there, if not untick everything and restart and see if the symptoms persist.

Sounds like malware/rootkit. Look for tools like Hijack This, Combofix, TDSS Remover. If you google them you will find people advising how to use them and other tools to assess what is up.

This isn't too scientific, just off the top of my head from what I remember last I sorted something like this.

miker1 · 14 May 2013 at 18:43

Yep, lots of other PCs.

That's another point - this machine cant be seen by others on the network!
It can see no-one else A message says "Network discovery and file sharing are turned off Network computers and files are not visible. Click for change."

Trouble is they wont turn on!!

theheyes · 14 May 2013 at 19:06

Burn yourself an offline scanner to disc -Windows Defender Offline or Avira's version. Boot from that disc and run a scan.

miker1 · 14 May 2013 at 19:22

Bullguard online has come up with these [so far....]

Trojan.GenericKDV.988508
Trojan.GenericKDZ.17846
Trojan.GenericKDV.96662
Trojan.GenericKDV.978532

Considering I had sodding AV stuff running I am a bit ****ed to get these and maybe more!!

davestar_delux · 14 May 2013 at 20:23

AV only protects against known threats. These things get modified as soon as they are detected.

And as soon as something hooks into Windows at a lower level then it has more power than the AV and can just shut it down.

KIA · 14 May 2013 at 20:58

Java?

davestar_delux · 14 May 2013 at 21:03

Also you need to run something to remove rootkits, the trojan is just tip of an iceberg really.

Rootkit revealer, icesword ought to show more up.

miker1 · 15 May 2013 at 08:20

Thanks for the help, folks. :clap:

I hope its fixed now

ray:

Eventually I had to system restore and and hope!
All else failed - even safe mode stuff.

Suddenly everything seed fine on the d/ls - installed Malwarebytes [again] and tried the Kaspersky trial - Malware found nowt while Kaspersky claimed about 8 things,

Strangely Mal only accessed 300k files on a "full" scan, while Kasp found 2.5million+!!

So now I hope that they have found everything and there is nothing lurking in the depths!

First virus I have had since 1992/3!

squarehead94 · 17 May 2013 at 01:25

sounded like a virus, use malware bytes to clean it.

kyle1970 · 17 May 2013 at 08:58

if all else fails,try combofix! super tool thats saved my a** loads of times.