Generic.Botget problem and more

[vortexm]

Hello,

I've been receiving lately a message that "C:\Windows\system32\services.exe" has performed illegal opperation and computer has to shut down. my antivirus (BitDefender 9) detects a file i.exe (on the same folder) and says it's infected with Generic.Botget blockes it. Yet,the computer is running very very slow afterwards and takes a lot of time to shut down (when i decide to reboot).
I did everything you suggested in "Viruses/Spyware/Malware, preliminary removal instructions." -didn't help. I attach the logs.

thanx for helping

 

[howard_hopkinso]

Hello and welcome to Techspot.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.


Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

launcher.ocx
patch.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {6754A456-BAD9-11D4-93D3-00B0D03A2F91} - (no file)

O16 - DPF: Toki Toki Boom -

O16 - DPF: Video Poker -

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} -

O16 - DPF: {36C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDKey Class) - http://www.cdkeybonus.com/cdkey/ITCDKey.cab

O16 - DPF: {37F59CC7-717C-4949-BA8F-6C70D6DA0651} -

O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} -

O16 - DPF: {BAA165DA-1DAF-4F18-9A28-E0D2D3937A1F} (Wrapper Class) - http://webevents.broadcast.com/wsp/VisionBrowser.CAB

O16 - DPF: {EC9C20C4-FF24-11D3-81B7-00902776CF54} (InstallerActiveX Class) - http://www.netex.co.il/site/Installer.CAB

O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com//games/v43/h2hpool/h2hpool.cab

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\WINDOWS\Downloaded Program Files\launcher.ocx
C:\TV Shows\MATH - Mathtype 5.2+Keygen.zip
C:\Temp\Apllications\Mathtype<Delete the entire folder.
C:\Documents and Settings\Mosheg\My Documents\Matlab\moshe\CircuitMaker +TraxMaker 2000.zip
C:\Temp\Apllications\Circuit Maker 2000 SP1

Reboot into normal mode and rehide your protected OS files.

Post fresh HJT and AVG Antispyware logs.

Regards Howard :wave: :wave:

This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[vortexm]

thanx Howard,

i followed the instructions but it seems ( from HJT) it didnt go away.
i attach the logs as requested.

Moshe

 

[howard_hopkinso]

Delete all files in AVG Antispyware quarantine.

Go HERE and install one of the free firewall programmes.

Then, run this Online scanner. You will need to use IE for this.

Post the results of the above scan as well as a fresh HJT log.

Regards Howard

This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[vortexm]

Deleted the quarantined files on AVG.
Downloaded zonealarm and it blocked 15 attempts to access from unknown IP.
I attach reports as requested.

Regards,
Moshe

 

[howard_hopkinso]

We need to temporarily disable Spybot search & Destroy`s tea time, as it may interfere with any fix we are trying to run.

Disable Spybot's TeaTimer. This is a two step process.
First:
- Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
- Choose Exit Spybot S&D Resident
Second:
- Open Spybot S&D
- Click Mode, check Advanced Mode
- Go To Left Panel, Click Tools, then also in left panel, click Resident
- If your firewall raises a question, say OK
- Uncheck the box labeled Resident Tea-Timer and OK any prompts.
- Use File, Exit to terminate Spybot
- Reboot your machine for the changes to take effect.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {6754A456-BAD9-11D4-93D3-00B0D03A2F91} - (no file)

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

Fix any O16 - DPF: entry you don`t recognise.

O17 - HKLM\System\CCS\Services\Tcpip\..\{59CD7552-D75B-4796-8E28-12686F533D0E}: NameServer = 192.168.0.1

O17 - HKLM\System\CCS\Services\Tcpip\..\{A7FA670C-EB32-418C-875E-9485D622C7B6}: NameServer = 212.117.129.5 212.116.161.38

Only fix the above 017 entries if they doesn`t belong to your ISP.

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

Click on the fix checked button.

Close HJT and reboot your system. Re-enable spybot`s teatimer.

Other than the above, your HJT log is clean.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[vortexm]

Hello again,

I keep getting a message "language pack installation" pops up frequently. I dont see any proccess linked to it on 'Process explorer' and I think it has something to do with the previous problem. Every time it pops up I get an alert the firewall.

Regards
Moshe

 

[howard_hopkinso]

Your HJT log is clean.

You`re running a completely unpatched version of Windows. You should run the Windows updates and install at least service pack 1 and preferably service pack 2.

See if that cures your problem.

Regards Howard

This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.