I need some help please!

[paulina]

Hello i am new at your forum and i am also new having nod32 on my pc!
I realy much about computers and my english are not so good!i had a virus got to my pc recently i took my pc to a pcstore but they hapend not to do much!tryong by my self cant do anything about a message it is coming up! so here it is!i will realy apreciaty if you may help me!!!!

probably a variant of Win32/Bancodor.AB trojan found in operating memory. The file can be deleted. It is strongly recommended that you back up any crucial data before you proceed. No action can be taken while the file is in memory. Click "Leave" to continue and subsequently run the cleaning of all local disks. System memory infection originated from file C:\WINDOWS\system32\xvid.dll.

[Blackspear]

Hi paulina, welcome to Wilders.

Please check your settings against those found HERE (http://www.wilderssecurity.com/showthread.php?t=37509)

After this run a scan by following these steps:

1. Click on the NOD32 Control Centre (Green and White split square on the bottom right hand corner of your computers screen).
2. Click on NOD32.
3. Click on Run NOD32.
4. Click on “Scan and Clean”.

Let us know how you go...

Cheers ;D

[paulina]

ok thank for your time!
i am just going to check what ever you told me!But i think all the settings are as you say at your msg!I will come back to tell you!
every time i am opening my pc the msg from nod32 is the same it saying to me that i can only Leave not other option then it is star scaning another msg comes up and the delete option is on!so i press delete it is saying to me to restart my pc i am doing it it!things happend to be ok!but when i close my pc and open it the next day the same situation is keep going! :(
i will do now what you are saying to me and i will be back to informe you!thank you one more time!

[Blackspear]

{QUOTE-> ok thank for your time! <-QUOTE}You are welcome.

{QUOTE-> i am just going to check what ever you told me!But i think all the settings are as you say at your msg! <-QUOTE}With those settings in place there will not be any prompts, everything is automated.

{QUOTE-> every time i am opening my pc the msg from nod32 is the same it saying to me that i can only Leave not other option then it is star scaning another msg comes up and the delete option is on!so i press delete it is saying to me to restart my pc i am doing it it!things happend to be ok!but when i close my pc and open it the next day the same situation is keep going! :( <-QUOTE}See above answer.

Cheers ;D

[paulina]

ok!
i have just done wath ever your msg told me!
I went to the page and i take it after instaling!I have marked many things that they was not checked!
i am now scaning i can see on the top of the scanning this!

this what is keep coming up!!!!i do not know what to do to get it out!!!!how can you help me with this!???
scanning this moment is on 57%

[paulina]

sorry dint show up as i want it!i meen this msg come up!

probably a variant of Win32/Bancodor.ABtrojan found in operating memory.System memory infection originated from file C:\WINDOWS\system32\xvid.dll.

[paulina]

After finnishing scan i have 3 lines in red that says:

C:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029158.dll-probably a variant of win32/Bacodor.AB trojan

C:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029197.dll-probably a variant of win32/Bacodor.AB trojan

and one more

C:\WINDOWS\system32\xvid.dll.probably a variant of win32/Bacodor.AB trojan

now it is says to me to restart my pc!i will do it!
but i am sure that this will come up again if i scan!i realy dont know what to do to get it out of my pc and i am so sad because i am trying a week now to fix it but nothing is happening! :-[ :-[ :-[

[ASpace]

{QUOTE-> sorry dint show up as i want it!i meen this msg come up!

probably a variant of Win32/Bancodor.ABtrojan found in operating memory.System memory infection originated from file C:\WINDOWS\system32\xvid.dll. <-QUOTE}


Hello !

Download Avenger from http://swandog46.geekstogo.com/avenger.zip
Exctact it into new folder

Start Avenger . Choose Load script manually .

Type exactly as written in two line
{QUOTE-> Files to delete:
%windir%\system32\xvid.dll <-QUOTE}


Click on the button with the lights and choose restart when prompt

After restart , the malware files should be gone

After restart perform full scan with NOD32 to check

How is it now?

[ASpace]

{QUOTE-> After finnishing scan i have 3 lines in red that says:

C:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029158.dll-probably a variant of win32/Bacodor.AB trojan

C:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029197.dll-probably a variant of win32/Bacodor.AB trojan

<-QUOTE}

Ok , restart your machines . Upon restart the dll file should be gone .
If so you can miss my previous post about Avenger.

If the malware comes again , it will be because of System Restore , special function with which saves Windows stuff . You need to disable it .

From FAQ from Blackspear http://www.wilderssecurity.com/showpost.php?p=824161
WARNING: Turning OFF System Restore means you will NOT be able to ROLL BACK your computer to the current state it is in.

Report back your results , pls

[paulina]

ok ihave restart my pc ......i must do a scun again to see if the dll files are gone????if they are gone i dont have to download Avenger?

[paulina]

Because i am not so good on pc's i am trying to do my best to solve this problem with your help!!! :)
if i do this :
(Please turn off System Restore: Note by turning OFF System Restore you will NOT be able to ROLL BACK your computer to the current state it is in.

Windows XP Instructions (reference with screen images)

1. Right click on the “My Computer” icon on the Windows desktop.

2. Click “Properties”.

3. Click on the “System Restore”.

4. Place a tick in “Turn off System Restore on all Drives”.

5. Click OK.

6. Close and RESTART your system.


Then please check your NOD32 settings against those found HERE

After this run a further scan with NOD32 by clicking on the NOD32 Control Centre> NOD32> Run NOD32> Scan and Clean.

Let us know how you go...)

then what is going to happend to the system?is it going to be as it is?everytning will work properly?or problelms will come up to the system?i am asking because i do not know :wacko:

[paulina]

i have scaned again!
i have 1 red line on the top of the scanpage same as before!
this:
probably a variant of Win32/Bancodor.ABtrojan found in operating memory.System memory infection originated from file C:\WINDOWS\system32\xvid.dll.

and 2 red lines in the total result

the one is much same as before with a diffrent numbers!

C:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029216.dll-probably a variant of win32/Bacodor.AB trojan

and this is same as before
C:\WINDOWS\system32\xvid.dll.probably a variant of win32/Bacodor.AB trojan

i hope i am explaning this problem right so you may understand what i am trying to say to you! :)

[ASpace]

Hello Paulina .

I would like to start with System Restore . Generally I am not allowed to comment it and suggest turning it off .

Here is what you have , I'll try to explain it so that you can understand ;)

You have a malware -> trojan horse , which is loading in memory and protecting it self very well . Because of the info we have I can't be 100% sure but it is most likely this dll file has "injected" itself into a legitimate Windows process such as explorer.exe . Explorer.exe is a Windows process and because of that well-protected by Windows itself . Because of that it is extremely difficult to any AV software to kill that trojan because it is loaded .

On the other site System Restore is a special function in Windows operating system which helps users to restore their computers to previous states exactly as they were . This is really useful if there is a system crash , for example ot after installing a buggy software , for example . Trojan horses are programs like every others and that's why Windows stores traces in System Restore about them . Windows cannot recongnise that a particual application is unwanted . Again , System Restore is something very important and is protected by Windows .

People need to disable System Restore function temporary because because this will delete all restore points and thus will prevent the malware regenerate from that folder:

Pros of disabling System Restore
Eliminate the malware from that folder and prevent Windows regenerate a copy of the trojan / essential! /

Cons of disabling System Restore
If somehow something bad happens to the system you will not able (in no way) to return back and restore . Anyway , the risk is very small


Generally I am not allowed to advise such thing but ... I would suggest you disable System Restore by the instuctions of Blackspear . This Note by turning OFF System Restore you will NOT be able to ROLL BACK your computer to the current state it is in means that although the risk is little , we cannot guarantee 100% nothing will happed , God this is malware . I have been cleaning computers for some years and have never had problems with System Restore , though .


About the other part
C:\WINDOWS\system32\xvid.dll

Temporary forget about Avenger and anything previous

Download UnDll - the DLL removal utility (author Paolo Monti , ESET Italy) http://www.nod32.it/tools/UNDLL.ZIP

Extract it into a new folder .

Run the application . Choose "Select infected DLL" (C:\WINDOWS\system32\xvid.dll) and follow the instructions .


After restart ,boot in Safe Mode (how: http://support.microsoft.com/kb/315222) follow Blackspear's advise to run full scan from Start->Program->ESET->NOD32

Report back your results ,pls ! :)

[paulina]

Hi-tech thank you very much for your replay!
I have understand a lot of what you have wrote to me!
So i will go and fix the system :-\ hope to do it well!!!!!if you see that i have not came back meens i have mess up my pc!:-[
i will informe you soon as possible for the results!i will also download what you have sugest about dll.!
i have spoke to the person i have took my pc to fix it and he told me bring it again to do a format!i realy dont know what a format is but he told me my pc will be ok!
so before going to do format i will try what you are telling me to do!
thank you again for your time to write to me!i realy apreciaty it! :)

[paulina]

i have one question before starting do sut down the system if i do it i must restart tha system or it is coming back automaticly?i know this might be a stupid question but as i told you i am not a ginius with pc programming!:-\
please answer to me so i can start on! thank you!

[Blackspear]

{QUOTE-> i have one question before starting do sut down the system if i do it i must restart tha system or it is coming back automaticly?i know this might be a stupid question but as i told you i am not a ginius with pc programming!:-\
please answer to me so i can start on! thank you! <-QUOTE}Once you turn OFF System Restore, then you can reboot your system and the file will be gone. After this you can turn System Restore back on.

Cheers ;D

[paulina]

ok!thank you!
i am on my way to do it!
cross your fingers!:blink:

[Blackspear]

One trolling post removed and reply that quoted said post also removed.

Blackspear.

[paulina]

ok now here are the results!
i have download the Undll unziped it (realy i didnt know how but i think i have manged it! :))
i have run undll programm and when i have opend to find dll files they where so many!i realy didnt know wich one to press!so i went with the direction of the msg that was coming up after scaning this

C:\WINDOWS\system32\xvid.dll
in that file most of them was in color blue but the xvid.dll was black but i have marked it for a scan with undll it did it and told me to restart my pc i did that also!
after i went and marked the system restore and it is still marked i restard my pc again ....after that i checked all the settings of nod32 they were as before (i meen everything ok as you told me by your post to do them!) and i start scaning with nod.....
the results was:
again on the top of the scan page

probably a variant of Win32/Bancodor.ABtrojan found in operating memory.System memory infection originated from file C:\WINDOWS\system32\xvid.dll

then one the results was only this
C:\WINDOWS\system32\xvid.dll.probably a variant of win32/Bacodor.AB trojan

the 2 other msg that was coming on before
:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029158.dll-probably a variant of win32/Bacodor.AB trojan

C:\System Volum Information\_restore{EBE67A5F-D489-4F9C-9098-8E8ECE5D887A}A0029197.dll-probably a variant of win32/Bacodor.AB trojan
THEY WHERE NOT THERE!!!!

so i think we have fix half problem dont you think?
what is your opinion on this?
do i have to unmark again the system restore?what i must do from this point?
i didnt do a good job to the undll program????:-\

[ctrlaltdelete]

Maybe u can find more information in the logfile that UNDLL.EXE made.

The logfile is in the same map where UNDLL.EXE is.

[Get]

You ran Undll.exe before you stopped system restore. Should be done the other way around.

[paulina]

cntraltdelete thank you i may check it!

Get you meen to turn of first the system and then to scan with undll?

ouffff dont know what to do.......i need some answers to the questions of my above post.. :'(

[Blackspear]

1. Make sure System Restore is turn back on.

2. Reboot your computer

3. Run a further scan with NOD32 by doing the following:

4. Open up the NOD32 Control Centre

5. Click on NOD32> Run NOD32 (on demand scanner)

6. Click on Scan and Clean

7. Let us know if anything is found.

Cheers ;D

[paulina]

thank you for your answer!
I have down what youhave told me to turn back on my restor system and i have cliked for scan since the moment that scaning started the same msg came up on the top of the scaning page! :(
probably a variant of Win32/Bancodor.ABtrojan found in operating memory.System memory infection originated from file C:\WINDOWS\system32\xvid.dll

dont know what else i must do!
do you think it is possible to do what i told you in msg?

[paulina]

yes the results of scaning itis the same as before!
C:\WINDOWS\system32\xvid.dll.probably a variant of win32/Bacodor.AB trojan
nothing diffrenet :-[

[Blackspear]

Please download and run HijackThis from HERE (http://www.wilderssecurity.com/showthread.php?t=12516)

Please download and run Autoruns from HERE (http://www.sysinternals.com/Utilities/Autoruns.html)

Please download and run Lookinmypc from HERE (http://www.lookinmypc.com)

Then forward the logs from all three programs to support @ eset.com with a link to this thread.

Let us know how you go…

Cheers ;D

[ctrlaltdelete]

Did u click on "Scan only" or Scan & Clean" ?

[Get]

{QUOTE-> Get you meen to turn of first the system and then to scan with undll? <-QUOTE}
Yes, I did, but it doesn't matter anymore now, because Eset-support will help you further.

[paulina]

Blackspear i will do just now what you have told me!thank you hope to have good results!

cntrlaltdelete i have done both!nothing beter happend!i usely do scan & delete!

Get thank you for your time anyway!
i am going now to do what blackspear tels me!

thank you all!

[paulina]

Blackspear i dont understand this?i dont know what are you trying to say to me???please if it possible to you to explain to me :wacko:
Then forward the logs from all three programs to support @ eset.com with a link to this thread.

[paulina]

it is very funny if your in some place to see me!!!xaxaaxax!!!
I have download them i have all of three programms in front of me and i am just looking them and dont know what to do with it!xaxaxax
i am stupiddddddddddddd!;D

[Get]

When you're done staring read this : :)

Hijackthis: Unzip in a new folder. Doubleclick "HijackThis.exe". Click "Do a system scan and save a logfile. The logfile (hijackthis.log) will be in the new folder.

Autoruns: Unzip in a new folder. Doubleclick "autoruns.exe". Scanning will start immediately. When it's done click on "File" on top (left) of the screen and click "Save". The log (AutoRuns.txt) will be in the folder.

LookInMyPc: Doubleclick "setupLMPC.exe". Click "Next" on every screen untill you reach the "Shortcuts to install"-screen (the 5th screen I think). On that screen put a tick next to "Install desktop shortcut for LookInMyPc" and then click "Next". On the next screen click "Finish". Doubleclick the LookInMyPc-icon on your desktop. Click "Generate report". When it's done a browserscreen will open with the log. Close this. You can find the log in "C:\Program Files\LookInMyPC\Reports". There's a folder with your username in it and the log is in there. It's the zipfile named "LookInMyPC.zip".

[ASpace]

{QUOTE-> When you're done staring read this : :)

Hijackthis: Unzip in a new folder. Doubleclick "HijackThis.exe". Click "Do a system scan and save a logfile. The logfile (hijackthis.log) will be in the new folder.

Autoruns: Unzip in a new folder. Doubleclick "autoruns.exe". Scanning will start immediately. When it's done click on "File" on top (left) of the screen and click "Save". The log (AutoRuns.txt) will be in the folder.

LookInMyPc: Doubleclick "setupLMPC.exe". Click "Next" on every screen untill you reach the "Shortcuts to install"-screen (the 5th screen I think). On that screen put a tick next to "Install desktop shortcut for LookInMyPc" and then click "Next". On the next screen click "Finish". Doubleclick the LookInMyPc-icon on your desktop. Click "Generate report". When it's done a browserscreen will open with the log. Close this. You can find the log in "C:\Program Files\LookInMyPC\Reports". There's a folder with your username in it and the log is in there. It's the zipfile named "LookInMyPC.zip". <-QUOTE}


and after you find these log files , mail them to ESET's Tech Support support@eset.com

Sorry I wasn't in help

Good luck and pls report back your results , we'll be interested

[paulina]

ok i have an idea what i must try to do!
i have read your post!!i realy realy apreciaty your help from all!!!
I have just read it i havent done anything yet i will be gone for the weekend so i will be back on monday morning!
the question is that from the programm Hijack and lookinmypc i found how to get a report but from the other one autorun i havent find how i am going to get a report i will do what ever you told me in your new posts!!!thank you very much!!!!!you are all very polite and helpfull please forgive my english are not so good!!!have a nice and relaxing weekend!
my best regards
paulina:)

[Get]

{QUOTE-> but from the other one autorun i havent find how i am going to get a report <-QUOTE}

http://img132.imageshack.us/img132/2415/autobl5.jpg

[paulina]

hello,
i am back again!
i have just make a report from the 3 programs you have told me and mail it from my mail to support@eset.com
now what i am expecting of them?are the going to answer to me here in the forum?or they going to send me a mail to my mail?

[paulina]

i have send the e-mail with all the results of the programms to support@eset.com and this is the answer i have got......

Hello,

I haven't found anything suspicious in the log. Once you have deleted the file xvid.dll, your computer should be clean.

But i am not so sure that deleting this file from the system will take out the virus i have because today i have scaned with nod32 after 3 days i have it close my pc and it found another spot with infection exept the one we had always it saw to me that a file volume had an infection same as before!
I am very desipointed :( and sad also :'( dont what else i must do!

what is your opinion after all this......?

[Blackspear]

{QUOTE-> Once you have deleted the file xvid.dll, your computer should be clean. <-QUOTE}

Let's start with that, then run a further manual scan and see what it comes up with.

Cheers ;D

[paulina]

Since m to do that i tried yesterday to delete it!
But it is not geting out for some reson......
i went as it says windows system32 xvid.dll and nothing happens it is keep saying to me file can not delete it.....
it saying to me exacly yhis that it is impossible to delete xvid because it is not allow to get through
please be sure that your disk are not full, that does not have writing protection and the file is not in use this moment!
that is exacly what is wrote when i am trying to delete that file...

[ctrlaltdelete]

Did u really removed the file before with UNDLL ??

[ctrlaltdelete]

I made some (Dutch) pictures, maybe it helps.

Start UNDLL.EXE

And select infected DLL

184903

[ctrlaltdelete]

1. select the C:\WINDOWS\system32\ folder
2. click on xvid.dll
3. click on "Open"

184904

[ctrlaltdelete]

... and follow further instructions on screen.

[paulina]

i havent done it that way!i just went to delete it!i will go as you say!!!i will be back!thank you!

[paulina]

ok! i went as you told me i have done it! i restart my pc!
i am doing scan and i am geting the same results! :(

[ctrlaltdelete]

C:\WINDOWS\system32\xvid.dll is back? ???

[Blackspear]

Please try the following:

1. Download, install and update the NOD32 Beta version 2.7

2. Tweak NOD32 up to its maximum settings (http://www.wilderssecurity.com/showthread.php?t=37509)

3. Make sure you are logged in as an Administrator.

4. Disconnect any network connections.

5. Turn off System Restore: Note by turning OFF System Restore you will NOT be able to ROLL BACK your computer to the current state it is in.

Windows XP Instructions (reference with screen images (http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039?OpenDocument&src=sec_doc_nam))

a. Right click on the “My Computer” icon on the Windows desktop.

b. Click “Properties”.

c. Click on the “System Restore”.

d. Place a tick in “Turn off System Restore on all Drives”.

e. Click OK.

f. Close and RESTART your system.

g. Make sure you are logged in as an Administrator.


6. Run 2 scans with the latest beta 2.7 - one with anti-stealth enabled and the other with anti-stealth disabled.

If the total number of scanned files does not match, it must be a new rootkit.

Let us know how you go…

Cheers ;D

[paulina]

her i am again with some results!
i found an old friend and he told me to download a program named kaspersky and i have done it and it take all the infections out in once!!!
now i am doing scan with nod32 and always when i waas strting scan before a mesage was coming up in the system operation now it OK!!!!
scaning is finishing and i think everything is ok!i will tell you the total results in a few minuts!:)

[paulina]

After scaning with nod32 results are:
Number of threts found is 0!!!!!!!!!!!!!!!!!!
and i am telling all this because you have helped me so much and mabe nod32 need to get something that the other program have .......dont know much but mabe that the 2 programs was working together virus is gone!
thank you one more time for your respense to my problem! :)

[Get]

{QUOTE-> a program named kaspersky <-QUOTE}

You installed kaspersky anti-virus? Without uninstalling nod32? If so, uninstall kaspersky, because 2 antivirusses isn't a good idea. Also congratulations with your clean pc. :)

[paulina]

yes i think kaspersky is an adivirus programm it scan as same as nod32 .....and yes i have both now....i havent a problem with it .....i will delete it!
thank you i am so happy!
hope it was the last!

[Blackspear]

Hi paulina, please post a copy of the Kaspersky logs, this will show us what the infection was.

Cheers ;D

[paulina]

When you meen logs you meen the results?

[Blackspear]

{QUOTE-> When you meen logs you meen the results? <-QUOTE}Yes, we would like to see what was detected.

Cheers ;D

[paulina]

I dont know where i can get all the results in that programm but i remeber very clear that he found the same problem in system32/xvid.dll in windows and in the volums the ones i have told you!
But he found more and in difrent names.......i am trying to find where i can see what was it but it is no were!I looked in the reports that the programm have and it not saying anything difrenet from what i am telling you now most of it is about the system32 ......it something else i must do to find what you need?
I tried after scaning to find in system32 the virus named xvid.dll and it was not there!
after when i havethe report in front of me i can not make a copy and paste to you for some reson!
but in caradine dosent have anything and in the only report it has says only about the syste32 nothing about the other virus it came out!
sorry i am not helpfull as you were!

[Get]

Open Kaspersky-> (leftside of the screen) leftclick "Service" -> leftclick "Data Files" -> leftclick "Files" (under "Reports", right-hand side of the screen) -> leftclick the "Detected-tab" -> rightclick on what is found (it turns blue) -> choose "Select All" (everything what's found turns blue) -> rightclick again -> choose "Copy" -> Open Notepad -> rightclick in the opened textfile and choose "Paste" -> save the file and copy the text in your next post here. Can't really go wrong I would say.:)

[paulina]

get i dont think i so stupid :(
but when i open kaspersky i have tree choices!
fist Protection Settings Suport
in Protection i have
Scan my computer
Scan removable drives
Scan objetcts
Update now
View Quarantine
View Reports

In Settings i have
Confiqure Real Time Protection
Confiqure On Demand Scan
Confiqure Updateer
Confiqure Quarantine
Additional Settings

And in Support

Send questions to tech support (i opent it but it dosent have anything that will help you!)
Send file for analysis (same as above!)
License key
Help
How to
Virus Encyclopedia
Kaspersky Labs Website


thats thats it have ......i can not find anything that you are telling me :(

[pc-support]

{QUOTE-> Can't really go wrong I would say.:) <-QUOTE}

You were saying? :P

[Get]

{QUOTE-> i can not find anything that you are telling me :( <-QUOTE}
You are using kaspersky 5. I was talking about 6. "View Reports" under "Protection" must be the same thing, but I guess you already looked there..?

@pc-support: http://img47.imageshack.us/img47/3126/20tp4.gif