Fucking Virus!!!

EATTHEDEAD · November 4th, 2009, 02:28 PM

Just a few minutes ago I got a warning while playing a game offline. Some bullshit program called "Security Tool" decided to download itself and make itself at home. Now I can't run my anti-virus or my Malware Bytes and I'm getting little pop ups in the taskbar telling me that both my anti-virus AND malware bytes are infected. I know this is bullshit. It won't allow me to start in safe mode and everything on my desktop has vanished, just a black screen. Has anyone had to deal with this? If so, would someone please help me to eradicate this shit from my PC?

RORER-714 · November 4th, 2009, 03:08 PM

http://housecall.trendmicro.com/

EATTHEDEAD · November 4th, 2009, 03:17 PM

It won't let me run the application Rorer. I can't download anything and run it. I need a manual way to get rid of this thing. Goddamn thing won't let me run my registry edit either. I can't even get the task manager to open. Well, it opens, for about 1.3 seconds and then this virus tells me it's infected and shuts it down. It is telling me everything is infected, even the program I dwnlded from your link.

Curdled_Pus · November 4th, 2009, 03:27 PM

I read what you said.
You cannot Download this? http://download.bleepingcomputer.com/grinler/rkill.com
If so I will be waiting here. I have to restart Fx so will be right. This is a nasty one. Is this what it looks like?
And just to confirm. You can't start in Safe mode right.

EATTHEDEAD · November 4th, 2009, 03:31 PM

I haven't visited your link yet, but yeah it won't let me into safe mode.
Going to your link now. Hope this works.

EATTHEDEAD · November 4th, 2009, 03:33 PM

Nope. it says rkill.com is infected too. The virus is known as "Lsas.Blaster.Keylogger. Your pic above is accurate.

Curdled_Pus · November 4th, 2009, 03:48 PM

It appears that it is associated with vundo which has always been a real nasty one.

I am going by this guide but will look further & see what I can find as all the actions I would suggest are disabled for now http://www.bleepingcomputer.com/viru...-security-tool
I would HIGHLY suggest you open a new tab & make an account at http://www.bleepingcomputer.com/foru...ct=Reg&CODE=00
and post there & keep this tab opened & refresh it as someone may be experienced with this booger. You need professional help with this one. In the subject I would the name of the infection & give the link above.
I would like to follow the thread there if you would be so inclined.

EDIT:By a wild chance in the brief moment the task manager opens if you can right click real quick & find & kill this nasty. It's wild I know

Gogo · November 4th, 2009, 03:56 PM

EATTHEDEAD, I got that one too...the only solution was to lose everything and reinstall my entire system to factory condition.
Was a pain in the ass, but I tried everything else...
Best of luck.

Curdled_Pus · November 4th, 2009, 03:56 PM

Do you have another PC that has net access to? If no in your house what about a neighbors? I've had to do that one myself when I thought I had a key-logger.
Before answering can you open & play a CD?? I found a possible workaround with tools I have pushed here before

Curdled_Pus · November 4th, 2009, 03:59 PM

Quote:

Originally Posted by Gogo

EATTHEDEAD, I got that one too...the only solution was to lose everything and reinstall my entire system to factory condition.
Was a pain in the ass, but I tried everything else...
Best of luck.

Yeah, that's a last resort & that is if he has recent backups. If he has a key-logger or a real nasty Trojan buried in the bios real deep after reformatting it may still be there.

EDIT: ETD On a side note, what anti-virus are you using?

Curdled_Pus · November 4th, 2009, 04:06 PM

We need access to your task manager. If we can get in there it's licked

Curdled_Pus · November 4th, 2009, 04:12 PM

Do you have HijackThis installed on your PC? http://free.antivirus.com/hijackthis/
If by chance wild can you run it?

EDIT: Or killbox? http://www.killbox.net/

We want to somehow download & install Process Explorer http://www.filehippo.com/download_process_explorer/
If so you need to rename procexp.exe to explorer.exe then you should be able to open this tool.
If you find a way Process Explorer is immune to this infection as log as it is renamed.

ETD has logged off so can add here.

Right clicked the icon for total security, open the properties, and look at where the .exe file is located. It probably has a numbered file folder "xxxxxxx". Look inside the folder & find the Icon with a xxxxx.exe file. Chang the last number in the folder and exe file. Reboot your PC. The PC might/should come up to where you can run Malwarebytes.

EATTHEDEAD · November 4th, 2009, 04:36 PM

I registered at Bleeping Computer and am waiting for a response to my queries. I am going to try what you suggested C_P and will get back to you. Thank you for all of your help. I WILL beat this motherfucker into submission! BTW, using AVG free, latest version. It also tells me that Windows Media Player is infected and won't let it open.

Curdled_Pus · November 4th, 2009, 04:46 PM

What, you so stressed out you need to listen to some relaxing music? Lol

EATTHEDEAD · November 4th, 2009, 04:50 PM

Quote:

Originally Posted by Curdled_Pus

What, you so stressed out you need to listen to some relaxing music? Lol

If the PC would allow it LOL. I'm going through the hoops to get into an online college and the last thing I need right now is a computer that is retarded.

November 4th, 2009, 02:28 PM	#1 (permalink)
EATTHEDEAD EMPIRE Join Date: Jan 2007 Location: Saving money on car insurance. Posts: 3,254	Fucking Virus!!! Just a few minutes ago I got a warning while playing a game offline. Some bullshit program called "Security Tool" decided to download itself and make itself at home. Now I can't run my anti-virus or my Malware Bytes and I'm getting little pop ups in the taskbar telling me that both my anti-virus AND malware bytes are infected. I know this is bullshit. It won't allow me to start in safe mode and everything on my desktop has vanished, just a black screen. Has anyone had to deal with this? If so, would someone please help me to eradicate this shit from my PC? __________________ "If its true that our species is alone in the universe, then I'd have to say the universe aimed rather low and settled for very little" -- George Carlin (1937-2008)

November 4th, 2009, 03:08 PM	#2 (permalink)
RORER-714 Administrator Join Date: May 2006 Posts: 11,523	http://housecall.trendmicro.com/ __________________ .

November 4th, 2009, 03:17 PM	#3 (permalink)
EATTHEDEAD EMPIRE Join Date: Jan 2007 Location: Saving money on car insurance. Posts: 3,254	It won't let me run the application Rorer. I can't download anything and run it. I need a manual way to get rid of this thing. Goddamn thing won't let me run my registry edit either. I can't even get the task manager to open. Well, it opens, for about 1.3 seconds and then this virus tells me it's infected and shuts it down. It is telling me everything is infected, even the program I dwnlded from your link. __________________ "If its true that our species is alone in the universe, then I'd have to say the universe aimed rather low and settled for very little" -- George Carlin (1937-2008)

November 4th, 2009, 03:31 PM	#5 (permalink)
EATTHEDEAD EMPIRE Join Date: Jan 2007 Location: Saving money on car insurance. Posts: 3,254	I haven't visited your link yet, but yeah it won't let me into safe mode. Going to your link now. Hope this works. __________________ "If its true that our species is alone in the universe, then I'd have to say the universe aimed rather low and settled for very little" -- George Carlin (1937-2008)

November 4th, 2009, 03:33 PM	#6 (permalink)
EATTHEDEAD EMPIRE Join Date: Jan 2007 Location: Saving money on car insurance. Posts: 3,254	Nope. it says rkill.com is infected too. The virus is known as "Lsas.Blaster.Keylogger. Your pic above is accurate. __________________ "If its true that our species is alone in the universe, then I'd have to say the universe aimed rather low and settled for very little" -- George Carlin (1937-2008)

November 4th, 2009, 03:56 PM	#8 (permalink)
Gogo Psycho Moderator Join Date: Jun 2009 Location: detox Posts: 1,301	EATTHEDEAD, I got that one too...the only solution was to lose everything and reinstall my entire system to factory condition. Was a pain in the ass, but I tried everything else... Best of luck. __________________ blood blood gimme blood - bloody bloody bloody - bloody blood

November 4th, 2009, 04:36 PM	#13 (permalink)
EATTHEDEAD EMPIRE Join Date: Jan 2007 Location: Saving money on car insurance. Posts: 3,254	I registered at Bleeping Computer and am waiting for a response to my queries. I am going to try what you suggested C_P and will get back to you. Thank you for all of your help. I WILL beat this motherfucker into submission! BTW, using AVG free, latest version. It also tells me that Windows Media Player is infected and won't let it open. __________________ "If its true that our species is alone in the universe, then I'd have to say the universe aimed rather low and settled for very little" -- George Carlin (1937-2008) Last edited by EATTHEDEAD; November 4th, 2009 at 04:38 PM..

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode