[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1268
  • Last Modified:

small.APC trojan horse creats irsbzdvy.dll anyone see this and had any luck removing it?

I have a infected computer with a windows login trojan horse small.APC it installs a dll irsbzdvy.dll.
When this happens on log in you get a desktop with no icons or start menu. I worked around the issue by chance: I renamed the explorer.exe to explorer2.exe and found that explorer2.exe would run by using the task manager. I then changed the shell in the registry to use the explorer2.exe and was able to boot into safe mode anduse msconfig and run in diagnostic start up and remove the trojan.

PROBLEM as soon as I restart in regular mobe and reset the mscomfig the dll shows up again.(irsbzdvy.dll) Any one see his before or have any ideas?
0
taagangel
Asked:
taagangel
2 Solutions
 
David-HowardCommented:
SDFix should remove this.
http://www.bleepingcomputer.com/files/sdfix.php
You might also try downloading, updating and running in Safe Mode Malwarebytes.
You can get it free from www.malwarebytes.org
Once updated, reboot into Safe Mode (F8 at startup) and run a scan.
You should do this with your current antivirus product as well.
David
0
 
taagangelAuthor Commented:
Ran malwarebytes multiple times in safe mode it appered it removed it and I ran hyjackthis multiple times until the dll was no longer showing up. It reapered as soon as I restarted normally. I will run the sdfix in save mode and see what happens and rerun the malware and virus and then see if that takes care of it.

Thanks
0
 
davidpmCommented:
Just want to add that when you clean a virus or malware from your machine one of the first things you should do is disable system restore. This is not a recommended procedure unless you are infected and cannot seem to remove the virus. Many of these newer viruses have code that backs it up to the system restore folder and will spawn a new copy once you have removed it so you have to clean out the system restore data which will keep you from ever restoring to an earlier time after you are done so once you are done make sure you turn it back on and create a new restore point.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now