Identifying is half the battle

patchwolf · Mar 21, 2006

Hi guys, new member.

My boss has gone and gotten himself into trouble again. I know there's a virus on his system, and I'm in the process of installing NOD32 on his computer, but am running into some difficulty. If I knew which virus he had, I'd be able to remove it...

Symptoms:
- blocks access to anti-virus websites
- ends the taskman process as soon as it begins (except for safe mode)
- deletes instances of nod32.exe and nod32kui.exe (and I assume other anti-virus exes) as soon as they appear (I tried copying the deleted files.)

Suspicious activity:
- in the system folder, there are dozens of files which fit this pattern: [10 random digits].exe

Just last week he had the Win.Bagle virus, which I removed. I know this is not the Fantibag or Zafi viruses, but I can't work out what it might be.

He finally approved the purchase of NOD32 Enterprise Edition, and his is the last computer to go. As soon as I get rid of this one, I can install NOD and get on with more interesting work.

Has anyone got any ideas for me? How can I identify this without the usual tools?

chaslang · Mar 22, 2006

Welcome to Majorgeeks!

Without the usual tools you will not be able to identify anything!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

First download HOSTER and then follow the below steps.

Unzip Hoster to a convenient folder such as C:\Hoster

Run Hoster.exe, click Restore Original Hosts and then click OK.

Click the X to exit the program

Now continue on to standard cleaning steps

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

.

Log in or Sign up

Identifying is half the battle

patchwolf Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member