# Trojan: Backdoor.Win32.Bifrose.aj how to remove?



## KarumA (Apr 21, 2007)

first off i wanted to say hello to everyone here, i have been struggling with this trojan for 2 days now and i am about to rip out every hair on my head because of it
i googled about 3 hours ago and found a topic made in this forums regarding the same problem, however i was able to follow the 1st part of the topic untill at somepart things got discussed that i had no clue on what it was about, hence the topic i am making right now and you guys seemed so helpfull thus i decided to test my luck here

first off the story so far, well lets begin at the start
friday morning when i wanted to boot up World of Warcraft the WoW launcher gave me a message saying this

'The trojan Backdoor.Win32.Bifrose.aej has been found on your computer

please remove it before continiueing to play, this trojan may be used to steal your personal acount information'

however i later found out with google that the name of the trojan was in fact 
Backdoor.Win32.Bifrose.aj

first thing i did, like anyone would, was to start scanning with my virus scanner (AVG Anti-Virus version 7.5) however it came out with the results that there were 0 threats on my PC
after that i tried Ad-Aware with the same result..

it was then that i posted up a message on the world of warcraft board to see if a GM (admin wow helpdesk person) could help me out, he only gave me a list of programs that could remove the trojoan, these included NOD32, Fix Wareout and Kaspersky, i used the programs and scanned in both normal windows mode and windows safe mode, the results were the same: 0 threats

the GM didnt know what to do and i heard that there were more people with the same problem, some of them however were able to trace it with KasperSky, i tried again this morning and this afternoon but without result (still 0 threats)

as for KasperSky, i still had it installed about an hour ago untill when i rebooted my pc from save mode it froze, i got stuck as soon as my windows got loaded and had to reboot, i concluded from the blue screen that KasperSky had been permanently damaged (meaning that windows blue screen couldnt repair it) i was able to boot up using system recovery (the system recovry failed but it turns of your anti virus and firewall when you reboot it) and was able to repair KasperSky, however the problem didnt dissapear and i was forced to uninstall it

the programs i did use to scan are the following, all of them said that i had 0 threats in ym system:

AVG 7.5 Anti-Virus
Spy Doctor
Spy Sweeper
Ad-Aware
KasperSky
A Square

i did some looking through my computer to seek the files that BifRose uses itself to discuise in your registry here are my results, the following is a list of the files it discuises itself as form this site http://www.spywareremove.com/removeBackdoorBifrose.html

Remove Backdoor.Bifrose processes: 
backdoor.bifrose.a_(319).exe
xvid-1.0.3-beta3-setup.exe
backdoor.bifrose.a.exe
ap2.exe
ap0.exe
~565.exe
msconf.exe

Remove Backdoor.Bifrose registry values: 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\xvid
HKEY_LOCAL_MACHINE\software\xvid
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runstartkey

Unregister Backdoor.Bifrose DLL files:
system.dll
pxwma.dll

Detect and Delete these Backdoor.Bifrose files:
backdoor.bifrose.a_(319).exe
xvid-1.0.3-beta3-setup.exe
backdoor.bifrose.a.exe
ap2.exe
ap0.exe
~565.exe
msconf.exe
system.dll
pxwma.dll
uninstall.lnk​
i used the above list and searched for them in the normal windows search mode however i only got a respond to system:

mmsystem.dll 
locations:
C:/windows/system32
C:/windows/system
C:\WINDOWS\ServicePackFiles\i386

i am not sure wether or not it belongs to the trojan (my properties and version say it belongs to windows XP)

as for a small notification, i am not a computer wiz, my knowledge is merely limited and in the topic i read they spoke of a prgram called Hijack This (i think it was), i dont have that program on my pc (dont even know what it does)

programs i do have installed at the moment:

Comodo Firewall
AVG Anti-Virus 7.5
A Square
CCleaner

sorry for the long topic talk and thanks for the help


----------



## KarumA (Apr 21, 2007)

i would like to let ou know that my problem has been solvs, how it got solved i got no clue, i scanned all night yesterday and somehow its gone now  topic closed


----------

