Virus/trojan, please help me

By Sjlasjla
Jul 15, 2009
  1. Hi there,
    Recently I logged on to my computer, and my anti-virus (Norton Security Suite) won't start, When I try to go to the menu, to enable it, (Right click > Norton security suite) Nothing happens.
    I also detected some suspicious files running with taskmanager, like reader_s.exe, 4.TMP, and alot of svchost.exe processes..

    I attached a log from hijackthis, when all programs were turned off, except notepad.

    Thanks in advance!
    P.S. Don't mind my english, I am dutch :)
  2. cosmido

    cosmido TS Rookie Posts: 20


    reader_s.exe is a VIRUT infection, it's very dangerous
    It come from P2P.
    Save right now all your personal data >> on CD

    For manage the deployment of this infection
    • Try to don't close/reboot your pc
    • When it's not necessary, let Internet connection close and if you can use another pc for download them following fix, it's better.
    • Deactivate System restore :
    (you'll reactivate it after all next step.)

    Begin by delete process (infection).
    • Open Hijackthis --> [Open the Misc Tools section] --> [Open process manager]
    • Select reader_s.exe --> press [Kill process] (remind is path)

    Do same thing with these ones who were in hijackthis.
    • C:\WINDOWS\system32\7.tmp
    • C:\WINDOWS\system32\C.tmp
    • C:\WINDOWS\system32\servises.exe
    • C:\WINDOWS\system32\regedit.exe

    >> • Make same thing for other new process (infection).

    Show hidden file and directory.
    • If you need it for this task, use Fix Policies.

    After that, delete all of these "previous" infection on the disk.

    Download FlashDisinfector :
    • If your antivirus react on Flash Disinfectopr --> deactivate is real-time protection,
    • Double-click on Flash_Disinfector.exe,
    • Follow instructions (plug all your USB External support..),
    • Press Ok to make reappear the desktop

    Download Dr.Web :
    • Run it .. start the fast scan
    • If processus are found --> select : Yes for all

    When fast scan is complete
    • select Options > Change configuration
    • select Scanner, and unhook heuristic Analyse
    • In main menu : select Analyse all,
    • Select the green arrow for start the Scan --> a pub will appear close it.
    • Click Yes for all ; if a file is find

    When the scan is complete, if infection are find
    • Chose "Select All" and Disinfection
    • If unable to make the disinfection ; select Quanrantine
    • In Main menu --> file --> save report on your desk
    • Restart computer (important)

    Download AVPTool :

    Restart.. in Safe Mode
    • At the bip / Bios screen, press on "F8" (several time),
    • Chose safe Mode,
    • Enter in your usual account.

    ► Launch the AVPTool
    • Hook everything and all disk.

    When scan is complete
    • Press on [Report] for Save the report
    • post the report

    Post all report and another hiajckthis.
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...