AV killer?need help!

Discussion in 'malware problems & news' started by rebelyuz, Aug 16, 2004.

Thread Status:
Not open for further replies.
  1. rebelyuz

    rebelyuz Registered Member

    Joined:
    Aug 1, 2004
    Posts:
    11
    i need help with my pc. im using winXP i noticed my AVG and The Cleaner wont run,i suspect an AV killer preventing me from using my anti virus sofware,i cant access MSCONFIG either,i cant uninstall my AVG nor can i install.is there any way i could fix this before i resort to reformating?what are other free reliable AV software i can use?please help... :'(
     
  2. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Try booting into safe mode and then running a scan with AVG

    Let us know how you go...

    Cheers :D
     
  3. bigc73542

    bigc73542 Retired Moderator

    Joined:
    Sep 21, 2003
    Posts:
    23,934
    Location:
    SW. Oklahoma
  4. rebelyuz

    rebelyuz Registered Member

    Joined:
    Aug 1, 2004
    Posts:
    11
    i cant go safe mode,when i press f8 it only toggles a boot sequence menu,i try the online scans...
     
  5. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    Ok, let us know how you go...

    If you are unable to do the online scans, then try downloading a copy of "Stinger" from here:

    http://vil.nai.com/vil/stinger/

    Let us know how you go...

    Cheers :D
     
  6. rebelyuz

    rebelyuz Registered Member

    Joined:
    Aug 1, 2004
    Posts:
    11
    i tried Bitdefender,and detected Backdoor.SDBot.Gen which was repaired,then Trojan.Qhosts.B w/c was found on C:/windows/system32/drivers/host,i tried to scan it with Dr. Web and it turned out to be a Win32.HLLW.Agobot.3 internet worm (no wonder my PC just slowed down together with my internet connection),it said it went under the name LSAS.exe that can be found on C:/windows/system32,i only found a LSASS.exe.Bitdefender couldnt repair it btw,so i tried stinger,it detected the TrojanQhosts.B and repaired the infected file,it detected another one DcomRpc.Gen trojan and deleted the file,made a 2nd scan with Bit defender then with stinger,no more viruses detected,i think its ok now,my problem now is how to make my AV run again,and to beable to access msconfig and windows task manager.i dont know how to repair the registry.
     
  7. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    You might try reloading Windows over the top of itself.

    Hope this helps...

    Cheers :D
     
  8. rebelyuz

    rebelyuz Registered Member

    Joined:
    Aug 1, 2004
    Posts:
    11
    ill try that THANKS A LOT! :-*
     
  9. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Please keep us informed how it goes.

    You mentioned the HOSTS file? If you look at that, anything strange? Can you access every site normally? If not, rename the HOSTS file and try again.

    If the AV blocking infections have gone, can't you just run the AVG and other functions normally?
    I would recommend to try one or two different online scanners too, as all have their own detections.

    Is/was going back to an older system-restore point no good option for you?

    BTW: also make sure your folder settings display all hidden files and extensions, to ease finding files for you.
     
  10. rebelyuz

    rebelyuz Registered Member

    Joined:
    Aug 1, 2004
    Posts:
    11
    as of now i have no problem accessing sites,by the way the host file was under C:/WINDOWS/system32/drivers/etc/host,and not c:/WINDOWS/system32/drivers/host,it was already repaired,with stinger.i cant restore my pc since i turned off system-restore when i was scanning,so to prevent the virus from being saved together with the restore points,thus keeping it from getting removed.i tried restarting the AV still aint functioning.i guess il try more online scans.... :(
     
  11. Blackspear

    Blackspear Global Moderator

    Joined:
    Dec 2, 2002
    Posts:
    15,115
    Location:
    Gold Coast, Queensland, Australia
    If this is your only problem, then try uninstalling your AV, delete all traces from the registry and reinstall...

    Cheers :D
     
  12. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    I would assume that one of the baddies is still running

    In this case and only this time as we don't normally do HJt logs here any more please do this and I will look over the log and advise if we can fix it

    go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
    make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
    Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
    Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
    It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
    so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
     
  13. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    I've moved this to trojans and backdoors as I strongly suspect that there is at least one agobot or sdbot if not more still active
     
  14. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.