Need Help With Virus Removal

mariannegamble

Bitdefender 2010

MS Windows XP, Home Edition V2 SP3

Desktop HP Pavilion a257c

Virus locations:

C:\WINDOWS\system32\ernel32.dll

C:\WINDOWS\system32\spool\prtprocs\w32x86

computer>properties>"system restore tab" content now looks like the "general" information tab

so there is no obvious way to "turn off system restore"

CD burner stopped working

Flash drive stopped working but now works after running %temp% and deleting temporary files using unlocker 1.8.8

Internet only goes to pop ups

I was able to do a deep scan with bitdefender

I copied the scan log to word, and then to a flash drive

I am very affraid to load it on my laptop, which is what I am using now

Thanks

Find more posts tagged with

Comments

Cristi Raducu

Hello mariannegamble,

Can you send me by PM the word file containing the deep scan results?

Also run BDSI and GMER and send me by PM the logs.

Note: you need to upload the logs to www.sendspace.com or www.rapidshare.com or on any upload site of your choice and send only the links.

http://kb.bitdefender.com/KB490-en--The-sy...s-infected.html

Cristi Raducu

2 new files were signed as Trojan.BHO.OHU after analyzing the sent logs:

c:\windows\system32\setqp.dll

c:\windows\system32\oetqp.dll

Please run a BitDefender deep scan and post here the results

Note: make sure your BitDefender is up to date before running the scan.

mariannegamble

2 new files were signed as Trojan.BHO.OHU after analyzing the sent logs:

c:windowssystem32setqp.dll

c:windowssystem32oetqp.dll

Please run a BitDefender deep scan and post here the results

Note: make sure your BitDefender is up to date before running the scan.

I am not able to update BD

Last update 7-19-10 4:12:54

I get an error message

BD Support instructed me to create a rescue cd

System will not boot from the cd

I tried changing the bios to first boot from cd but it would not boot

Start in Safe mode will not work

Start in recovery will not work

I'll run a deep scan and post the results

Thanks,

Marianne

mariannegamble

BitDefender Log File

Product: BitDefender Total Security 2010

Version: BitDefender Antivirus Scanner

Scanning task: System Scan

Log date: 7/27/2010 3:00:02 AM

Log path: C:\Documents and Settings\All Users\Application Data\BitDefender\Desktop\Profiles\Logs\full_scan\1280214002_1_01.xml

Scan paths:

Path 0000: C:\

Path 0001: K:\

Scan Level:

Scan for viruses: Yes

Scan for adware: Yes

Scan for spyware: Yes

Scan for applications: Yes

Scan for dialers: Yes

Scan for rootkits: No

Scan for keyloggers: Yes

Virus Scanning Options:

Scan registry keys: Yes

Scan cookies: Yes

Scan boot sectors: Yes

Scan memory processes: Yes

Scan archives: No

Scan runtime packers: Yes

Scan e-mails: Yes

Scan all files: Yes

Heuristic Scan: Yes

Scanned extensions: not configured

Excluded extensions: not configured

Target Processing:

Default first action for infected objects: Disinfect

Default second action for infected objects: None

Default first action for suspect objects : None

Default second action for suspicious objects: None

Default action for hidden objects: None

Default first action for encrypted infected objects: Disinfect

Default second action for encrypted infected objects: None

Default first action for encrypted suspicious objects: None

Default second action for encrypted suspicious objects: None

Default action for password-protected objects: Log only

Scan Engines Summary

Virus signatures: 6560304

Archive plugins: 44

E-mail plugins: 6

Scan plugins: 14

System plugins: 5

Unpack plugins: 10

Basic

Scanned items: 459768

Infected items: 11

Suspect items: 0 (no suspected items have been detected)

Hidden items: 0 (the scan options do not include scanning for rootkits)

Resolved items: 11

Unresolved items: 0 (no issues remained unresolved)

Advanced

Scan time: 02:26:53

Files per second: 52

Skipped items: 304129

Password-protected items: 2

Over-compressed items: 0

Individual viruses found: 1

Scanned folders: 46128

Scanned boot sectors: 4

Scanned archives: 3006

Input-output errors: 28

Scanned processes: 70

Infected processes: 0

Scanned registry keys: 1822

Infected registry keys: 0

Scanned cookies: 246

Infected cookies: 0

Resolved issues:Object Path Threat Name Final Status

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2421\A0338742.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2422\A0338754.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2422\A0338755.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2422\A0339754.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2422\A0339755.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2423\A0339767.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2423\A0339768.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2423\A0340767.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2423\A0341772.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine

C:\WINDOWS\system32\ernel32.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine after reboot

C:\WINDOWS\system32\spool\prtprocs\w32x86\M1g9i17q.dll Gen:Trojan.Heur.P.cm4@carBkrf Moved to Quarantine after reboot

Not scanned objects:Object Path Reason: Final Status

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2419\A0338279.apm=>ams_xml_pl.xml Password-protected Not scanned (file was password-protected)

C:\System Volume Information\_restore{F20DC6C2-5212-4F33-8959-AB7D05D4CDB6}\RP2419\A0338279.apm=>ams_xml_temp.xml Password-protected Not scanned (file was password-protected)

mariannegamble

I was able to update BF with Cristi's recommendations.

The deep scan was sent in to the customer support email

I restarted the computer after the scan

I was not able to update BD again after that

The computer locked up

on restart it would not load Windows XP

I just run into dead ends when I tried to reboot

The system did attempt to reboot from the cd rom

The BD recover cd gave an error message

I have a set of 6 recovery cds for the computer, the 1st cd would not reboot

I tried a windows xp cd (2003)from my laptop as a repair and did not get very far.

I'm going to take the PC to a local shop and see if they can get windows to reboot and go from there