AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by lauri143, Dec 30, 2007.

  1. lauri143

    lauri143 Private E-2

    Hello!

    I have read your manual what should I do with the virus or malware. I scanned it with ccleaner, spybot, and now finally I did the scan with AVG Anti - spyware.
    First of all, AVG antivirus says that it's a virus and it cannot be deleted or moved to virus vault. AVG anti - spyware found out that it is a Trojan and I was able to move it to quarantine.

    My question is, how and what should I do next? I want to delete this file, because I think it's not good to be it in quarantine.

    Thanks,
    Lauri
     
    lauri143, Dec 30, 2007
    #1
  2. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Also I found out that bitsprx.dll works under my IE....Should I uninstall it and then update it to the latest version again?
     
    lauri143, Dec 30, 2007
    #2
  3. lauri143

    lauri143 Private E-2

    lauri143, Dec 30, 2007
    #3
  4. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Also I have scanned my computer with VundoFix V6.7.7 and it shows nothing. But still I am getting the message that bitsprx.dll is infected with Trojan.

    Any Ideas?
     
    lauri143, Dec 30, 2007
    #4
  5. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll - Urgent help please

    So what else did i found out. I found out that bitsprx.dll is in two places in the windows registry (HKEY_CLASSES_ROOT and HKEY_CLASSES_MACHINE)
    in the directories of CLSID and there you can find bitsprx.dll file. You cannot delete them. I wonder that in the safe mode those registry keys aren't written to there so that malware must be written in the startup of Windows.
    I couldn't locate any suspicious .exe files in the msconfig, services.msc and Task Manager.

    Also I found out that every time i open IE browser, it shows that viruse hault message that virus found bla bla blaa....
     
    lauri143, Dec 30, 2007
    #5
  6. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hi lauri143!
    Welcome to Major Geeks!

    In order to help the most people in the shortest amount of time, we try to do things in a methodical way. First I need to ask you if the links you posted in post #3 are live links to malware?

    Secondly, in order to be of any use to you at all, we need to see the logs we requested in the READ & RUN ME FIRST

    It is very rare for one virus to be alone. If you want us to help you, please complete the instructions and post the combofix, avg-antispyware (if there is one) and MGlogs.zip logs to us.

    Thanks!
    abri
     
    abri, Dec 30, 2007
    #6
  7. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hello abri!:)

    No, these link i posted in the 3rd post are not malware. I just could not attach files to this post like there was written in the manual... So I just copied the link location from my user interface. There are 2 files:
    1) ComboFix.txt
    2) MGlogs.zip

    So if you have read all my 5 or 6 posts then you can understand what's my problem. I just can't get rid of that bitsprx.dll file which is connected somehow to the IE (Browser Helper Object) - it cannot be removed any of these programs....

    PS! Now I got this attachment correctly to work. The problem was that it didn't identify files from my memory stick. It wanted to have files in the local computer. ;)

    Waiting for a response!

    Best wishes,
    Lauri
     

    Attached Files:

    lauri143, Dec 30, 2007
    #7
  8. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Also this bitsprx.dll is called as a Trojan.BHO.abo file....

    Any luck with my files with that previous post?:confused
     
    lauri143, Dec 30, 2007
    #8
  9. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hello?
    Is anyone dealing with my problem too?

    I attached the 3 files you wanted, but as I see, no-one hasn't clicked it yet...0 views....:cry
     
    lauri143, Dec 31, 2007
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hello? Has anyone read the stickies? ;)

    Each time you add a post, it is a bump and you lose your place in the queue. Which in turn makes it take longer for you to get help. Have you read the stickies???? See right at the top of the forum pages this one in particular: Don't Bump! It Only Hurts You!!!

    Even the way you started this thread with the multiple postings cost you time!


    First please use MSconfig to place your system into Normal Startup mode as was requested in the beginning of the READ & RUN ME.

    Is your copy of Spyware Doctor a paid version or free trial? If free, uninstall it now.


    Uninstall the below old versions of software:
    Java 2 Runtime Environment, SE v1.4.2_03
    Java(TM) 6 Update 2

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {DF08A1F9-3875-42BF-9175-9E497BC06C4F} - C:\WINDOWS\System32\bitsprx.dll

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    Last edited: Jan 1, 2008
    chaslang, Dec 31, 2007
    #10
  11. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hello and thank you for your reply.

    Now I know that I shouldn't done that. Just the problem was that I found out myself something and wanted to write it to here too that you guys can fix the problem out quicklier.

    So the avenger deletion did not help. Also I wasn't able to delete those files manually nor in Safe Mode.:(

    So I attached new MGLogs.zip and avenger.txt files. Both of these didn't help me at all...

    PS! I tried to log in with a different user and used a FTP client to log in with this Terri account. It also didn't help.

    Any other solutions?


    Regards,
    Lauri
     

    Attached Files:

    lauri143, Jan 1, 2008
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {DF08A1F9-3875-42BF-9175-9E497BC06C4F} - C:\WINDOWS\System32\bitsprx.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    After clicking Fix, exit HJT.


    Now print the below instructions because at a point during them you MUST (this is can be critical) shutdown all browsers. I will tell you when to exit the browsers during the muti-part procedure.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have the below icons on your Desktop (double click the thumbnail to expand it)
    CFScript.jpg
    • Now refer to the above image and use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from ComboFix.

    Make sure you tell me how things are working now!
     
    chaslang, Jan 1, 2008
    #12
  13. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll - Urgent help please

    hi chaslang,

    I did what you have told me to do. This virus is very annoying. After running the HJK and I pressed Fix - the virus came to my screen with a window (virus found - bitsprx.dll. It says AVG antivirus).

    Did I got you right that I had to put the CFscript.txt file on the top of ComboFix (just to drag it there?). The log file didn't find any infections.

    Btw...I have a solution maybe - If I try to boot this computer with a Linux Live CD, so I could maybe delete those files manually from Linux?

    I have restarted this laptop and nothing really happened. It is in the same phase as it was yesterday. It is getting me this AVG Threat detection windows - bitsprx.dll found.

    You wanted 2 files, so there they are :)
     

    Attached Files:

    lauri143, Jan 2, 2008
    #13
  14. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hi Laurie!

    Please do the following:

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Please let me know if you get a success message with this. If so, post a fresh MGlogs.zip

    abri
     
    abri, Jan 2, 2008
    #14
  15. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hello abri,

    It didn't work...

    I got an error message

    Cannot import fixme.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor.

    Any other solutions? I think that if I can't get rid of that virus the only way to get rid of it is to format...:cry
    =============================================

    NB! I sent you a private message of this post. I was able to delete the registry key with this fixme.reg file.

    I ran a GetLogs.bat and will post a new MGLogs.zip here...

    And btw I still see it in my registry...the same key I just deleted...:S

    Thanks,
    Lauri
     

    Attached Files:

    Last edited: Jan 2, 2008
    lauri143, Jan 2, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: AVG says virus bitsprx.dll - Urgent help please

    Yes but based on the log you attach, you did not do something properly. Try again. And make sure you follow the steps exactly.[/quote]
     
    chaslang, Jan 2, 2008
    #16
  17. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll - Urgent help please

    So I went over your steps again. Still didn't find any infections.

    Here are 2 files, ComboFix.txt and MGlogs.zip
     

    Attached Files:

    lauri143, Jan 2, 2008
    #17
  18. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hi laurie!

    I would like for you to try the following:

    Please go to the link below and download the free 30-day trial version of Kaspersky Antivirus. Download the installation program but do not install the program yet. First disconnect your computer from the internet completely and then uninstall AVG Antivirus via add/remove programs. After uninstalling AVG Antivirus, reboot your computer, but do not connect to the internet again. First install the Kaspersky Antivirus trial version and then allow it to scan your computer. Have it quarantine or delete anything it finds.

    Kaspersky Antivirus Trial

    abri
     
    abri, Jan 2, 2008
    #18
  19. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hello!

    I scanned with Kaspersky and it didn't find that bitsprx.dll is a virus. So my question is, what is it then? It's not a windows system file.

    bitsprx.dll ; status - "OK" ; Reason - iSwift....

    So there was no virus?:S

    Detected:
    deleted: virus Virus.Win32.Agent.aa File: C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP54\A0017957.exe
     
    Last edited: Jan 2, 2008
    lauri143, Jan 2, 2008
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Your problem with ComboFix not working appears to be because you did not follow the instructions in the original READ & RUN ME. You must download ComboFix.exe from the link we gave you and you did not do this. As a result you are using a very outdated version of ComboFix which is the reason none of the fixes have been working. Download the correct versions to your Desktop and repeat the steps in message # 12.
     
    chaslang, Jan 2, 2008
    #20
  21. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Omg...That's a piss *** reason that none of the fixes helped me =/
    So, i think ComboFix and that CFscript.txt helped me a lot here.

    Here you go the log and txt files.

    PS! Should I run HJK also for a complete scan?
     

    Attached Files:

    lauri143, Jan 2, 2008
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    I assume you meant HJT. You already ran it. It is part the GetLogs.bat scan.


    You're logs are clean. See how easy it is when the correct version of software is used. ;)


    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN
      • Now type combofix /u in the runbox and click OK.
      • Note: The space between the X and the U, it must be there.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
     
    chaslang, Jan 2, 2008
    #22
  23. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Ok! I did that. I turned the clock back to right date.

    But I still have infections. I run a full Kaspersky scan and it shows that some viruses found in C:\System Volume Information and some are in my documents...
     
    lauri143, Jan 3, 2008
    #23
  24. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hi laurie,
    did you have Kaspersky fix whatever it found?
    abri
     
    abri, Jan 3, 2008
    #24
  25. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Yes I ran a complete scan. It found some Win32 Trojan-s and I deleted them. But one virus I cannot delete, the one which is located in the "C:\System Volume Information\"

    I deleted the catalogue manually, but it keeps coming back and Kaspersky is reporting every time i reboot that, there is a virus when I scan the catalogue.

    Any solutions for that?
     
    lauri143, Jan 3, 2008
    #25
  26. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    What catalogue?
     
    abri, Jan 3, 2008
    #26
  27. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    System Volume Information is common only computers which have installed Windows with Win XP SP1 CD.

    C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP3 <---there is the virus... those RP1 - RP5 are kind a scary folders...

    Any solutions?
     
    lauri143, Jan 3, 2008
    #27
  28. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Yes. Do NOT try to delete these files manually. This can cause big problems. Your computer logs are clean. What you are seeing are the Restore Points which we asked you to keep on your computer until we finished with the cleaning instructions. The restore points can be cleaned now by following our final cleanup instructions which were posted to you by Chaslang in post #22. When you follow the final instructions Chaslang posted there, you will see in step 10 that he has asked you to turn off System Restore (as per the instructions), then to Reboot your computer, and finally turn System Restore back on. When you do this, all your previous restore points will be removed and a clean one will be set. Since Kaspersky did not find anything else, I recommend you do this.

    Afterwards Kaspersky should not find anything further and you can un-install it via add/remove programs. Be sure to uninstall it only when you are sure you have the installation file for AVG where you can find it. After this, disconnect from the internet, and remove the trial version of Kaspersky via add/remove programs. Reinstall AVG Antivirus and re-connect to the internet.

    It is very important while your computer is in this clean stage, that you go to Windows Updates and download all those updates you are missing. ONLY do this after you have set a clean restore point. In this way, if any of the updates cause problems for you, you can return to this one clean restore point.

    Thanks.
    abri
     
    abri, Jan 3, 2008
    #28
  29. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Hi abri,

    Thanks again for your help. I removed all files reading chaslangs post...So there are no combofix and MGlogs and etc, but...
    Now there is an icon next to MSN Live messenger - a black square. This isn't good at all...

    Any solutions for that? But the computer itself works well now.'

    Regards,
    Lauri
     
    lauri143, Jan 3, 2008
    #29
  30. abri

    abri MajorGeek

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Can you get us a screen shot of that?
     
    abri, Jan 3, 2008
    #30
  31. lauri143

    lauri143 Private E-2

    Re: AVG says virus bitsprx.dll (also bitsprx2.dll, bitsprx3.dll) - Urgent help please

    Sure, i will post that tomorrow. The laptop is at work. I can go there tomorrow :)

    I'll post it here then!:)
     
    lauri143, Jan 3, 2008
    #31

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds