Virus Alert: Backdoor.Agent.B

acehigh · Aug 5, 2004

Have a virus on my computer and not too sure how to get rid.

Pop up box appears saying Norton has detected a virus on your computer.

Object name: C:\WINDOWS\System32\kbddnfl.dll

Virus Name: Backdoor.Agent.B

Unable to repair this file.

Any idea guys how to remove this? Also mt system restore won't work, so i can't restore to an earlier date.

Thanks in advance.

chaslang · Aug 5, 2004

Just based upon the small amount of info provided, it sounds like you have the HSA hijack to me. Are your home pages and searches being hijacked? You should first work thru this link: http://forums.majorgeeks.com/showthread.php?t=35407

And then as it states at the end, if still having a problem and it is the Only the Best aka HSA hijacker, see this link: http://forums.majorgeeks.com/showthread.php?t=38772

acehigh · Aug 5, 2004

Thanks chaslang, i'll have a look at those links. My home page was hijacked for quite a while but after installing hijackthis, i have corrected it. This virus appeared afterwards.

chaslang · Aug 5, 2004

acehigh said:

Thanks chaslang, i'll have a look at those links. My home page was hijacked for quite a while but after installing hijackthis, i have corrected it. This virus appeared afterwards.
Click to expand...

If it is HSA, as I suspect, using HijackThis will only fix it temporarily. It will keep coming back due to a load of other items running which cannot simply be fixed using HJT.

You should do a few reboots and trying opening and closing a few Internet Explorer sessions to see if it comes back.

Where were the hijacks taking you to? Do you get popups?

If you try to delete the file you mentioned (C:\WINDOWS\System32\kbddnfl.dll ), you may not be able to do so or it may delete and one with a different name will take its place.

acehigh · Aug 5, 2004

That's correct. Using hijackthis i can select the Win32...but i cannot delete the file. The home page was hijacked by about:blank i think, but no longer reappears.

chaslang · Aug 5, 2004

acehigh said:

That's correct. Using hijackthis i can select the Win32...but i cannot delete the file. The home page was hijacked by about:blank i think, but no longer reappears.
Click to expand...

Okay so it sounds like you had the about:blank variation of the hijacker. But you think your problem is resolved?

Did you try to delete the file after booting in safe mode?

Log in or Sign up

Virus Alert: Backdoor.Agent.B

acehigh Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

acehigh Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

acehigh Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member