I admit defeat

[Seanohue]

Yes, it seems that even one as computer savvy as myself can be defeated by viruses. So now I must ask for others help to defeat this one. I'll try to describe it as best I can:

In the background, I keep hearing a clicking noise, like a new window is being opened. At some point, I'll start hearing commercials; no window or anything, just sound. The two files that seem to be controlling this is Indt2.sys and ndt2.sys, and both are located in the system32 folder. When I end those processes and delete the files in the system32 folder, the clicking stops and all is fine. But after a restart, the files are up and running again. Also, during boot-up, a "personalizing settings" window pops up the upper left corner to say that something is being configured in C:\WINDOWS\system32\Bifrost\server.exe. I'm thinking that this has to be what is causing the problems. I can locate the server.exe file through windows search, but I can't find the Bifrost folder in system32. Ad-Aware and AVG aren't picking up a single thing, so I have no idea what to do now.

[Old Sailor]

Do you have "view hidden folders" option checked, if not you won't see all important file stuff.

[Seanohue]

Yea, I have that checked; the Bifrost folder still won't show though.

[Old Sailor]

Ok, try this start, run, type in regedit, see if it shows that way any where. if so try deleting it there.

[Seanohue]

Ok, I can kill the folder now, but it still comes back after a restart. Is there anyway to track what has created that file?

[Old Sailor]

If it still comes back, its gotta be in the registry somewhere, usually the above post about regedit will remove all traces of it. Other than that I'm stumpped.

[Danh78]

Try running msconfig to see if you might find that service in the startup?

[JaKaAch]

Originally Posted by Old Sailor

If it still comes back, its gotta be in the registry somewhere, usually the above post about regedit will remove all traces of it. Other than that I'm stumpped.

I have read somewhere a virus can show back up after a restart because it is in a restore point. Delete all system restore points, that might get it.

[xxwaldoxx]

Check out www.geekstogo.com and head over to the forums

They have tons, and tons or info on Malware removal.

[Golfman]

yea turn windows restore off... because the virus is using that windows feature which regenerates deleted folders to prevent it from crashing against you. once you turn off system restore and delete the files they should be gone for good and problem solved.. just look online how t turn off system restore cuz i forgot hehe

[kvm]

Sounds like a variant of this.
http://www.symantec.com/security_res...151-99&tabid=2

You can start by disabling system restore and killing the process.
Then connect to trendmicro and run housecall to see if it can remove it.
I didn't check all the charateristics of it but if AVG was already installed on your system it may have been affected by it.

[Seanohue]

Killed it! The Bifrost folder had to be deleted through the registry and the Indt2.sys and ndt2.sys files were deleted in safemode. No more annoying clicks! Thanks for all the help guys

[Old Sailor]

[jjirons69]

Great job guys! What an aggravating problem to have.

I smile while reading as my Mac and I continue our bit and byte journeys...

[a2vr6]

Now get yourself a decent antivirus. I highly recommend Nod32, worth every penny and not a resource hog like Mcafee or Norton. Oh yeah, get a couple of spam sweeping tools on your machine and run a scan every week.