Backdoor.generic 699532 Trojan.generic6936374 Trojan.sirefef.bw

shanejohnston@rogers.com

Hi, I have Bitdefender Internet Security 2012

I have run the scan in Quickmode, Full scan as well as Rescue mode.

Each time, Bitdefender is able to delete some of the viruses, but not all. One of them

states it will be deleted on re-boot, however, on reboot, the viruses all appear back again.

When this started, I could still run windows as well as Internet although it was slow (CPU running at 98 -100%).

Now, the PC cannot even boot up windows. When I reboot or power down and back up, it comes to the screen

with selection "Run Bitdefender Rescue Mode" or "Boot up Windows Vista"

When I select "Run Bitedefender Rescue Mode" it just re-boot_s and takes me back to the exact same screen.

When I select "boot up with Windows Vista", it takes me to a screen for recover options.

I had previously seen a message on the board here, that I should disable Windows Recovery which would also delete any Windows

recovery set points (in order to get ride of Trojan.Sirefef.BW) so I did that which means I have no recovery options.

I cannot give you the scan logs since I can't get into Windows or Bitdefender.

Here are the viruses that Bitdefender found;

Trojan.Generic.6936374 c:\windows\assembly\GAC_32\Desktop.ini

Trojan.Generic.6936374 c:\windows\assembly\GAC_64\Desktop.ini

Backdoor.Generic.699532 (same directories per above)

Application.BitCoin Miner.1

On another scan, it picked up these viruses

Trojan.Generic.7210649 /mnt/sda3/Windows//Assembly/temp/U/00000002A

Backdoor.Generic.699532 /mnt/sda3/Windows/GAC_64/Desktop.ini

Trojan.Sirefef.BW /mnt/sda3/Windows/System32/consrv.dll

Then when I clicked on "Fix Issues - Delete"

The percentage complete bar appeared that it was

completed immediately (ie progress completion bar was all blue)

however, it stated that it was still fixing the issue but would never

finish.

I'm not sure what to do at this point ...what guidance can you give me

to do next?

thx ...Shane

rootkit

Hi Shane

Welcome to our forums.

In order to be able to further investigate the reported situation we need a bit more information from your computer as follows:

. A BDSYS log;

[how to GENERATE A BDSYS LOG]

. Save and extract the BDSYS tool to a location of your choice:

http://www.bitdefender.com/files/Knowledge.../BDSysLog_i.exe

. Make sure you close all active applications and then run "BDSysLog_i.exe"; If you receive a firewall

alert,select to Allow the application to connect;

. Click the "Create log" button to start generating the

log; A progress bar is indicating that the tool is creating the report;

. When the small window appears with the message "Log

saved" then the report is complete and a new file named "bdsyslog.zip" has appeared on your Desktop;

. Send me via PM the generated log file.

. If the file is to big for send it over PM, upload the results to one of the online file hosting servers mentioned below or use one of your own and send via PM the download link.

http://www.sendspace.com

http://www.mediafire.com

IMPORTANT:

.During this process the Real Time Protection in Bitdefender must be temporarily disabled;

.If you receive a Bitdefender Firewall alert to inform you that BDSysLog_i.exe tries to connect to the internet,then you need to select Allow;

[how to DISABLE THE ANTIVIRUS PROTECTION in Bitdefender 2012]

In order to disable the antivirus protection,please open Bitdefender and click the "Settings" button in the upper side part of the interface"; In the new window go to "Antivirus" > "Shield"tab and click on "Turn off" under On-access scanning.Select the time interval that suites your troubleshooting needs and click "OK" . The On-access scanning should be enabled back after finishing the troubleshooting procedure.

[How to create a screen shot]

On Windows, press the Print Screen or Prnt Scrn key on your keyboard, found at the upper right of the keyboard. This key will capture the entire screen. Open up your paint program -click on "Start-> All Programs-> Accessories->

Paint". In the paint program, select File/New, then Edit/Paste. Then save the file and attach it in your PM message.

If the file is to big for send it over PM, upload the results to one of the online file hosting servers mentioned below or use one of your own and send via PM the download link.

We will get back to you as soon as the analysis is complete. Have a nice day.