Virus on Computer

James240

Thanks Pchelpman, im not round my mums for about 4 days now as im away for a bit, ive told her not to go on the internet for the moment. Once i get back down to her (hopefully should be midweek) ill post the HJT log so to see exactly whats wrong

Thanks to everyone for their help so far as you have been a fantastic help :beer:

James

albertross_2

if hjt doesn't work, try autoruns, it does a similar thing. Did you run the bitdefender scan in safe mode?

James240

hi guys iom back round me mums at the moment, the autoruns link that Albertross gave runs and it throws up a backdoor.delf.hbi which has been detected by 8 bit defender, located in three files but given the file name it looks like there made up one :rolleyes:

Going to try and get HJT to run on the computer so cross fingers

James240

ok just tried to run HJT from a DVD-RW in normal mode and the virus is still terminating the program before its able to finish does anyone else know anything i can do ?

Browntoa

rename the HJT program to soemthing else and then run the scan...

ie

hijackthis.exe to james240exe

James240

ive already down that Browntoa but it seems to still know to end it before its finished

Browntoa

have you tried deleting the 3 files you found while in safe mode ??

are they DLL's or exe's ??

James240

there .dll's there the ones that are listed in post 30 mate

Ive just run the autoruns that albertross recommended to run and i saw them in there so ive deleted in that program in safe mode.

Although i then tried to run HJT again and it wouldnt let it just kept on stopping the program, same with AVG as well and quite a few of the other AV that people have recommended.

the only one that seems to run on the computer is 8 bitdefender but it doesnt seem to be able to get rid of it according to the report it gave me in post 30

James240

just run autorun again and 8 bit defender has picked up the same files as listed above in post 30 and the file names are exactly the same as before

James240

Browntoa the file path for these is

HKLM\software\microsoft\windowsnt\currentversion\winlogon\notify

Ive gone into REGEDIT to have a look and there seems to be two folders named erhecwjrbgbv and prmgkujwhutt which is what the virus scanner picked up.

Ive just tried deleting the folders, but when i go back into REGEDIT they have reappeared with everything intact .....