Downloader Viruses

As far as i could find out, the file securers.dll belong to a trojan, named Trojan.W32.Dialer (variants AY to CE). More info on this one, you find here http://www.pestpatrol.com/pestinfo/t/trojan_win32_dialer.asp

Because i don't know how you know that your computer is infected with the agent.ab, i can only give you a link and some advice. You can find info about this trojan-downloader at http://www.pestpatrol.com/pestinfo/t/trojandownloader_win32_agent_ab.asp

To get rid of both infections, you can probably use the online PestPatrol-scanner. However because agent.ab is a downloader, it is not unlikely that your computer is already infected with more malware. I strongly recomment that you scan your computer with your own virusscanner (ofcourse, after collecting the latest updates), as well as with AdAware and Spybot (both are downloadable free from charge).

Good luck! Jahewi

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

Download a program called CWShredder. Here's the link: http://209.133.47.12/~merijn/files/CWShredder.exe Run the program and let it get it's latest updates. Let the program run and when finished, reboot your system. JR I didn't find specific information on psw.banker.6.F. The psw.banker-'family' is very large. Search with google on 'psw.banker' and you will find out ;-) If you think you are infected with a banker-trojan, do a complete system-scan with AVG-antivirus (or with your own virusscanner). AVG is regularly updated with the latest banker-signatures. You can download AVG at http://free.grisoft.com/freeweb.php/doc/2/ Good luck, Jahewi :-)

A legal anti-spyware doesn't display false positives. The false positive method is used by rouge anti-spyware. There's no possibility to tell if your anti-spyware is legal or not unless you name it.

If your' anti-spyware is legal, then you are infected. As your anti-spyware detected this threat, i assume it can delete it.

You can enter the name of your antispyware into http://www.yahoo.com or http://www.google.com and read the reviews. If most

of reviews are bad, than your anti-spyware can be corrupted and use false positives to gain a purchase.

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

If you download The Cleaner 4.1 Professional and use the trial version for now, it will sniff out any possible trojans on your computer and delete the ones it quarantines. I've tried it and it was very effective. You can download it here: http://www.moosoft.com/products/cleaner/download/

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

the Ruledor.D Virus came when i arrived on this web site: ***://***.simplemp3s.com/ the virus immediately installed many spywares and Horoscope (!) files, developing a lot of false MS warning messages (telling my PC was not protected enough, & bla & bla...). The first of all, don't click on this pop ups windows... Juste do a ctr+alt delete and close all those apps.

Then, i ran Ad-Aware 6.0 and cleaned all new unwanted files. Then, i ran AVG which located the virus in C:/WINDOWS/bundles/CSV5P070.EXE that has been healed by the anti-virii. that's all folks!

You can remove many viruses on your computer using a program called The Cleaner Professional 4.1. You can find it here: http://www.moosoft.com/products/cleaner/download/

Make sure you use the "Evaluation" instead of registering right away or even buying it. Make sure it's the program you want and see if it will quarantine the virus or viruses. After they are quarantined you need to go into the actual quarantine section on the main Cleaner menu and delete everything it placed in there.

I ran AVG and and it found the two trojans you are having trouble with. It would get rid of them, move one to virus vault and I would delete out of virus vault. Then, then next day, AVG found them again. So, I dug deeper. I looked to see where they were being saved. Then, I went to the file where they were stored. I also ran Hi jack This before deleting anything to verify things. To make along story short, I found it in a temp folder called -Temp. It was below the regular folder Temp. If you look in the -Temp folder. You should see an Optimize.exe and an Instal~1.exe These are the ones that are giving problems. If you look in the Hi Jack This log, you should see some lines that reference this. Those need to be removed, because this is where the reinfection comes from. NOTE: These are located in the registry files, SO BECAREFUL as to what you delete. Make a copy of your registy file firt and research the lines in question. After I did all this I have not had any trouble since. My computer is alot faster now.

This worked for my situation, but may or may not for you.

Thanks and good luck!

Also, look for a WebRebates0.exe file.

You can find if it is running on a port and process name by typing at a command prompt Strat>run(Type "command") when you get to a command prompt type "netstat -obna" you will get a list of executable that are involved with each port or listening ports. You can get a list of commands for NETSTAT by typing "netstat ?" after you find the file name you might have to boot in safe mode to remove it. You can run it in intervals by typing "netstat -obna 5" the five is the number of seconds it waits to run again you may change this number. Also you can look at http://www.symantec.com and do a search at the top.

I'm using Windows 98se. This is the way I remove the Turown.A Trojan horse

Go to Start,Find,Files and folders, open, Type setup_TD.exe make sure you are searching on C: or whatever letter your hard drive is. Click on that file(setup_TD.exe and delete. Run you anti-virus and it will heal the infected files.Run again and it will say hopefull no virus found. Good Luck /this worked for me.

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

I had a problem similar to yours and I ran AVG and got a message saying that the virus was embedded.

I tried deleting it in safe mode, etc. So I searched my Temporary Internet Files folder and went into G9EJ8LMJ and my problem was the file loader exe, so I listed the folder by details looked for exe files and deleted it there manually. As I said my problem was loader exe so I suggest you look for bridge exe, before you delete it scan it with AVG just to make sure that is your problem.

P.S. Please have your system restore off or the virus will appear again. I have done this myself and spent 3 hours doing it, this should save you a lot of time and heartache.

Bridge wrote a script to download another copy of itself from the internet every time I opened IE (or Avant), so kept on appearing to "come back from the dead". Fortunately, HijackThis was able to locate the relvant script. It was then a matter of looking through the list of problems HijackThis came up with and deleting everything associated with the Trojan. The self-downloading script was very obvious in the HijackThis log.

I, too found the bridge.exe on my home computer. Here are some tips. If you delete it from the add/remove programs file in the control panel, it will come back. (At least, it has for me, on several occassions). Virus scan 7.0 does not seem to remove it properly. Neither does the Stinger componant I was told by a mcafee tech. to use. I went to the highjackthis site, and it found about 5 dozen files. I don't know what to files do delete! If anyone can help me, I would be very appreciative.

having read all the above may i also suggest to any other users that may experience this problem that they run msconfig and check the start up tab you will find bridge .exe loads a dll file on startup and this is why when u delete it it it still comes back if you untick this box and then remove from add remove progs and finally check your temp directory you will be able to reboot ok

Follow TJB post re downloader.4d. It worked for me.

The school I go to had the virus on there computers. The antivirus program could not take the virus out. I had to go into the registry, temp folder, quarintine folder, and system32 folder to remove the virus. Do a search in the registry and another search on your PC for the following files: bridge.exe and bridge.dll. There is a method in do so...it's a long process, but I managed to get it out.

See Symantec's Security website.

Run search, open the folder containing the bridge application, delete it. Usually in Temp files

All Trojan horses are hidden files so you would need to go to the Files Option (click the View tab)at Control Panel and uncheck both the *Hide file extension for known file types & *Hide protected operating system files (Recommended)-boxes, then OK yourself out. You will then need to restart your computer and and go into Safe Mode by holding the F8 key down -(kind of at the beginning of start up). When you're at the DeskTop screen go to Start/ Search/ For Files and Folders and type up the NAME OF THE FILE & EXT which would have shown up on your Anti-Virus software, you can delete this file from here.

I have had 4 Trojan horses on my C drive and kinda figured out the above method a week ago. I deleted the Temp file from the Restore folder after unchecking the hidden files boxes, then went to SafeMode to delete what virus files that were still there. My computer is now absolutely FREE of these pests!

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

I had the virus in my "System Volume Information" folder. I turned off the system backup and then turned it back on. This destorys all the XP restore points, but it did get rid of my virus.

I tried that, it didn't work. How else can it be removed?

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

I had Downloader.Small.5.N & Downloader.Bridge.A.

AVG found them but could not vault them. I ran Norton - didn't find them. Looked all over the internet. People suggested deleting from the files. Did not work. People suggested Spybot. I had already run that and that did not fix it. They suggested Ad-ware 6 and RegSeeker. I did both. Regseeker came up with 850 files to "delete". I was not going to delete 850 files!!! until I saw someone else say the same - and he had "taken the bull by the horns", shut his eyes and deleted without reperussion - so I did the same eventually. No prob so far. I also ran the Ad-ware 6 and deleted those files (Trusting!!) Still AVG said they were there. Rebooted, rescanned, still there. Then this morning (13.04.04) AVG said it had healed Downloader.Bridge.A. and not sign of Downloader.Small.5.N - obviously taken out by RegSeeker or Adware.

Have no idea what either Trojan Horse does but I have not been adverseley affected by any of this awful time - yet!!

It took me 3 full days of searching as neither of these were to be found anywhere.

Good luck.

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

I use AVG free version 6.0.684 with latest updates on a Win 98 P166Mhz 97Mb RAM PC. This seems to detect and heal downloader.keenval types B,C,D&E. My PC detects these in C:\program files\common files\updmgr. Q:Where have any other users discovered these viruses, and do you know how they infect PCs?

support.Microsoft.com

I found this link and haven't tried it yet but it's worth a shot and the best answer I have found to date. Hope it helps.

i have avg free version and it finds it, it found keenval.c, j and b twice. keeps coming back though....

The Trojan horse is install via Euniverse WUpdater - Part of the Kazaa software, deleting it and running Kazaa redownloads the software, the solution is to install Diet K dietk.com and let this remove all the background rubbish that is installed along side Kazaa.

You will also add some additional features to Kazaa, well worthwhile.

All Trojan horses are hidden files so you would need to go to the Files Option (click the View tab)at Control Panel and uncheck both the *Hide file extension for known file types & *Hide protected operating system files (Recommended)-boxes, then OK yourself out. You will then need to restart your computer and and go into Safe Mode by holding the F8 key down -(kind of at the beginning of bootup). When you're at the DeskTop screen go to Start/ Search/ For Files and Folders and type up the NAME OF THE FILE & EXT which would have shown up on your Anti-Virus software, you can delete this file from here. Also, make sure to empty your Recycle Bin.

I have had 4 Trojan horses on my C drive and kinda figured out the above method a week ago. I deleted the Temp file (as these keep putting the same files back into your system) from the Restore folder after unchecking the hidden files boxes, then went to SafeMode to delete what virus files that were still there. My computer is now absolutely FREE of these pests!

PS. I also have AVG 6.0 (the free one) & also the Ad-aware 6 and I use them every day as my kids love to play games from the Internet.

The Free AVG version will identify Trojans but doesn't delete them all. Some it will only heal (temporarily) depending on the criticality of the file.

It most cases AVG will pick up keenval c. Sometimes it identifies the existence of the Trojan during its DOS scan. When windows has fully loaded you should then run AVG from the windows desktop . Run Complete Test but make sure it is set to heal file. This should resolve your problem.

You may wish to try the links below which will provide you with free anti-Trojan software

http://www.emsisoft.com/en/software/free/

This next link is another Trojan software program which is free to evaluate for 30 days.

http://www.simplysup.com/tremover/download.HTML

Good Luck!

A Trojan horse has infected your system. For a user like you this really sucks. But I can help you. It seems like the author of the malware has incorporated the abilities of spyware and viruses. This combination is deadly for a system. By what you have said I take it that your internet connection still works. So instead of searching the internet for software that may have malware in it I would go to trendmicro.com and run housecall. Housecall will search the componets of your system to find active malware. The Trojan is still working so trendmicro will definitely find it. Once it finds it it will attempt to restore the damaged files, delete the Trojan, delete the file, quarintine the infected file or deny the Trojan access. This is the best solution in my opinion because the site has got it down to a science.

There is another solution but it will cost you around sixty bucks. You could go out and by a rescue CD that would attempt to heal your system.

Good luck,

Computer Guru

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

Here's what I know about "downloader.agent":

1/ The file-name extension (after the 2nd decimal point)varies. Such as "Downloader.Agent.A", "Downloader.Agent.AS", "Downloader.Agent.MM", etc. So far I've found at least 50 different extensions.

2/ It creates the file "Kernell32.exe" in Windows, which is NOT a Microsoft Windows file. This file over-writes your main Dynamic Link Library file, (Kernell32.dll), which controls memory allocation for programs, ability to display images, and browser functionality.

3/ It alters the files: "Autoexec.bat", "Config.sys", and "Command.com". These are the critical files to start your machine.

4/ It creates a directory from the C:\ prompt called: "_restore\temp". You will find hundreds of files in here with a ".CPY" extension, which are NOT part of Windows. It is a log of your activity which is transmitted to someplace called the "Kazaa Network" through Outlook without your knowledge everytime you logon. If you're on DSL, you are transmitting constantly without knowing it. This is what slows down your page loading and prevents you from using icons on your desktop.

It also creates a sub-folder in Windows called "Plaxo". (C:\Windows\Plaxo). In here, you will find more CPY files, and a file called "Plaxo.Log". If you view this file, you will see a record of every single thing you've done since inheriting the virus. To view it, open your MS-DOS prompt, change the directory to c:\windows\plaxo , and then type in TYPE: PLAXO.LOG|MORE

(the | is the "pipe" sign above your backslash which lets you view the file one page at a time.)

By viewing this file, you can pinpoint the date/time you caught the virus.

It is impossible to delete the infected files, since they are in use by Windows and access is denied. Even if you change the properties of the files to delete them, Windows will not work properly since key-Windows files have been altered.

The only answer I've found so far to get rid of it, unfortunately, is to save all your user files on floppys or burn them to a CD, and RESTORE Windows from your Restore disc of Microsoft Windows disc.

I repair PCs, and have worked on more than a dozen machines in the past month all with this same problem.

Hope this helps.

Bob

Right ok bob im no computer whizz i had one of these Trojan downloaders you are talking about, burn all your files from your computer then restore it, what are you talking about all i did was run avg free then quarentined it and then ran malwere bytes and all traces of the virus has gone.

so there is no need at all to fully restore you computer or anything like that

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

First off bridge.dll is a Trojan itself, so press start click run, type msconfig, click start up tab and uncheck bridge.dll if it is running on your startup, next click start, right click on my computer go to properties, click system restore take it off on all drives, then go to this link http://vil.nai.com/vil/stinger/ download the stinger antitrojan file run it on all drives, then i recommend you run avg free antivirus (at the same time if you like) these should get rid of them, also after you take off system restore go to control panel add remove programs and see if bridge.dll is on your program list uninstall it if it is (it wasnt for me) but if you do all this at the end just turn system restore back on should be gone or fixed by stinger :)

I experienced this on a cracks page running AVG: I had the AVG message about the bridge.dll Trojan come up asking me if I wanted to heal or ignore. I chose to heal, and I got a windows error saying the target of a file copy procedure (presumably the bridge.dll file) was missing. Does this mean it renamed itself already? I hope not. But I'm asking the people at Steve Gibson/AVG about it. When I run AVG on my windows/temp folder no viruses are present any longer (or so it says...) I haven't yet run the program on all drives.

I would like to know if anybody had similar experiences or knows what bridge.dll does (and will reveal this closely held trade secret...)

1. Download and run firefox to protect your computer from future spyware attacks and pop ups which are coming in through internet explorer (Trojan downloaders, win32 ).Browser attacks aren't easy to spot because they piggyback on legitimate traffic that doesn't exhibit many obvious warning signs

http://securitynewsfromthenet.blogspot.com/2007/05/spyware-fighter-essentials.html

2. Run the vundo and combo fix http://securitynewsfromthenet.blogspot.com/2007/05/vundofix-and-combo-fix.html

3. Run Malwarebytes Anti-Malware

http://securitynewsfromthenet.blogspot.com/2008/03/malwarebytes-anti-malware-105.html

4. Run the anti spyware remove programs spybot http://securitynewsfromthenet.blogspot.com/2007/03/spybot-search-and-destroy-spyware-and.html and superantispyware http://securitynewsfromthenet.blogspot.com/2007/04/superantispyware-home-edition-free.html to get rid of the nasties

5. Run a complete scan with free curing utility Dr.Web CureIt!

http://securitynewsfromthenet.blogspot.com/2008/05/dr-web-cureit.html

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?ID=62504

You need to run these 5 essential steps to remove all the spyware on your computer.

1. Run Deckard's System Scanner (DSS)

2. Run Malwarebytes Anti-Malware

3. Run the anti spyware removal programs spybot

4 Run Superantispyware

5. Run a complete scan with free curing utility Dr.Web CureIt!

Install threat fire which will enhance your antivirus protection

good news ppl ime running on windows xp pro edition.ive just had the virus agent.bf and i finally got rid of it.heres how-------follow this link-------> download.com

once downloaded install and run update immediatley.finally run adaware once it finishes click next and it will show you your log file.where you will see your hijacker.right click any file in the log and select all objects then press next.it will tell you that all the files that were interupting your system will be moved to quarentine click ok.then before going back to your internet browser goto tools internet options and put your homepage back in the top bar.once apllied close all browsers again and run an updated avg virus test.your system should be clean.if this also works for you just leave a message in thanks ;)

You can remove this virus by following these steps .

1 Download and intall the Malwarebytes on your computer .

2 Update your Malwarebytes .

3 Scan your computer for all the malwares in your computer .

4 Remove all the malwares , found while scanning with the malwarebytes .

5 Restart your computer .

its not a virus its a trogan hourse i would recomend downloading spysweeper or spybot....and you get lots of bad things on your computer from looking at porn...... not that im saying you do