AVG 2013 Says Volsnap Infected With Trojan Generic3_c.BNQG

Good!!

Please go to the http://www.bleepingcomputer.com/download/tdsskiller/
Select the .exe version
Double-click on TDSSKiller.exe to run the program.

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System
Click: OK

Press: Start Scan


•If a suspicious object is detected by this program, the default action is Skip. Leave this action as is, and click on: Continue
•If malicious objects are found, they show in the Scan results.
Ensure Cure (the default action) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)

When done, the tool creates a log on the disk with the Windows Operating System, normally C:\

Logs have a name like:
C:\TDSSKiller.X.X.X_1.05.2013_15.31.43_log.txt

Please attach the TDSSKiller log in your reply.

Notice any improvement?

Need to go out for a while, but will return @ o/a 8:00PM CST

mohavepc

Dont want to step on anyones toes . Just trying to help. Download the programs on a clean machine run the scans on the infected PC .

So yes run the tdsskiller on the infected PC

Upload it insterad of posting it!!

47 pages????

Holy schmollie...have never seen one that large.

Under Additional Options, you did not place a check on anything else other than the box next to: Detect TDLFS File System... I hope.

Ok new log with JUST Detect TDLFS File System Check marked lol.... sorry by bad.

16:04:24.0015 5408 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
16:04:24.0499 5408 ============================================================
16:04:24.0499 5408 Current date / time: 2013/05/24 16:04:24.0499
16:04:24.0499 5408 SystemInfo:
16:04:24.0499 5408
16:04:24.0499 5408 OS Version: 6.1.7601 ServicePack: 1.0
16:04:24.0499 5408 Product type: Workstation
16:04:24.0499 5408 ComputerName: HOLLY-PC
16:04:24.0499 5408 UserName: Holly
16:04:24.0499 5408 Windows directory: C:\windows
16:04:24.0499 5408 System windows directory: C:\windows
16:04:24.0499 5408 Processor architecture: Intel x86
16:04:24.0499 5408 Number of processors: 1
16:04:24.0499 5408 Page size: 0x1000
16:04:24.0499 5408 Boot type: Normal boot
16:04:24.0499 5408 ============================================================
16:04:26.0371 5408 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x76C1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
16:04:26.0387 5408 Drive \Device\Harddisk1\DR3 - Size: 0x1E150DE00 (7.52 Gb), SectorSize: 0x200, Cylinders: 0x3D5, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
16:04:26.0387 5408 ============================================================
16:04:26.0387 5408 \Device\Harddisk0\DR0:
16:04:26.0387 5408 MBR partitions:
16:04:26.0387 5408 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0x1BEAA800
16:04:26.0387 5408 \Device\Harddisk1\DR3:
16:04:26.0387 5408 MBR partitions:
16:04:26.0387 5408 ============================================================
16:04:26.0418 5408 C: <-> \Device\Harddisk0\DR0\Partition1
16:04:26.0418 5408 ============================================================
16:04:26.0418 5408 Initialize success
16:04:26.0418 5408 ============================================================
16:04:33.0609 6100 ============================================================
16:04:33.0609 6100 Scan started
16:04:33.0609 6100 Mode: Manual; TDLFS;
16:04:33.0609 6100 ============================================================
16:04:33.0609 6100 ============================================================
16:04:33.0609 6100 Scan finished
16:04:33.0609 6100 ============================================================
16:04:33.0625 3220 Detected object count: 0
16:04:33.0625 3220 Actual detected object count: 0
16:04:37.0041 4648 Deinitialize success


You forgot to tell me to Uncheck the other boxes....

Glad to help, mohavepc!