Comments on: Gusano Bagel http://www.bipolarplanet.com/~void/2007/12/02/gusano-bagel/ Back off, man, I'm co-creating my reality. Wed, 15 Oct 2008 23:43:34 +0000 http://wordpress.org/?v=2.6.1 By: Leslie http://www.bipolarplanet.com/~void/2007/12/02/gusano-bagel/#comment-1191 Leslie Sat, 26 Jan 2008 20:06:53 +0000 http://www.bipolarplanet.com/~void/2007/12/02/gusano-bagel/#comment-1191 Hey, Dmitry. It looks as if what you got is very similar. The file srosa.exe didn't show up in google search until several days after I posted it originally. Hey, Dmitry. It looks as if what you got is very similar. The file srosa.exe didn’t show up in google search until several days after I posted it originally.

]]> By: dmitry http://www.bipolarplanet.com/~void/2007/12/02/gusano-bagel/#comment-1190 dmitry Mon, 21 Jan 2008 12:03:55 +0000 http://www.bipolarplanet.com/~void/2007/12/02/gusano-bagel/#comment-1190 Hi I had nearly the same problem two days ago with Bagel.ii downloader. It took me whole day to figure out solution. Symptoms: - Norton antivirus crushes - Google toolbar produces strange messages - Installation of any antivirus product (Norton/Kaspersky/Panda) not working - No visible strange process - Safe mode not working Working Solution: Run windows from disk into recovery shell delete the following files: Windows/System32/mdelk.exe Windows/System32/drivers/hldrrr.exe Windows/System32/drivers/wintems.exe Windows/System32/drivers/srosa.sys Windows/System32/drivers/down/* If you use google toolbar, delete googleToolbarNorifier.exe Delete all antivirus installation (this trojan replaces main antivirus executable so if you dont remove it, when you restart it loads virus instead of antivirus :( ) Reload computer in Directory recovery mode - this mode, unlike safe mode, is working. If you have registry recovery, reset registry to date before infection to enable safe mode. If not - you loose safe mode and have to do hard work to recover it. In safe or directory recovery mode- Install kaspersky trial or any other good and most recently updated antivirus. Perform full scan and remove all ***. Hopefully you did it :) I hope this can help anyone with same problem -Dmitry Hi I had nearly the same problem two days ago with Bagel.ii downloader.
It took me whole day to figure out solution.
Symptoms:
- Norton antivirus crushes
- Google toolbar produces strange messages
- Installation of any antivirus product (Norton/Kaspersky/Panda) not working
- No visible strange process
- Safe mode not working
Working Solution:
Run windows from disk into recovery shell
delete the following files:
Windows/System32/mdelk.exe
Windows/System32/drivers/hldrrr.exe
Windows/System32/drivers/wintems.exe
Windows/System32/drivers/srosa.sys
Windows/System32/drivers/down/*

If you use google toolbar, delete googleToolbarNorifier.exe
Delete all antivirus installation (this trojan replaces main antivirus executable so if you dont remove it, when you restart it loads virus instead of antivirus :( )

Reload computer in Directory recovery mode - this mode, unlike safe mode, is working. If you have registry recovery, reset registry to date before infection to enable safe mode. If not - you loose safe mode and have to do hard work to recover it.

In safe or directory recovery mode- Install kaspersky trial or any other good and most recently updated antivirus. Perform full scan and remove all ***. Hopefully you did it :)

I hope this can help anyone with same problem
-Dmitry

]]>