TechSpot

Generic.Botget problem and more

By vortexm
Feb 9, 2007
  1. Hello,

    I've been receiving lately a message that "C:\Windows\system32\services.exe" has performed illegal opperation and computer has to shut down. my antivirus (BitDefender 9) detects a file i.exe (on the same folder) and says it's infected with Generic.Botget blockes it. Yet,the computer is running very very slow afterwards and takes a lot of time to shut down (when i decide to reboot).
    I did everything you suggested in "Viruses/Spyware/Malware, preliminary removal instructions." -didn't help. I attach the logs.

    thanx for helping
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.


    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    launcher.ocx
    patch.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {6754A456-BAD9-11D4-93D3-00B0D03A2F91} - (no file)

    O16 - DPF: Toki Toki Boom -

    O16 - DPF: Video Poker -

    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} -

    O16 - DPF: {36C66BBD-E667-4DAD-9682-58050E7C9FDC} (CDKey Class) - http://www.cdkeybonus.com/cdkey/ITCDKey.cab

    O16 - DPF: {37F59CC7-717C-4949-BA8F-6C70D6DA0651} -

    O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} -

    O16 - DPF: {BAA165DA-1DAF-4F18-9A28-E0D2D3937A1F} (Wrapper Class) - http://webevents.broadcast.com/wsp/VisionBrowser.CAB

    O16 - DPF: {EC9C20C4-FF24-11D3-81B7-00902776CF54} (InstallerActiveX Class) - http://www.netex.co.il/site/Installer.CAB

    O16 - DPF: {FAE74270-E5EE-49C3-B816-EA8B4D55F38F} (H2hPool Control) - http://mirror.worldwinner.com//games/v43/h2hpool/h2hpool.cab

    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\WINDOWS\Downloaded Program Files\launcher.ocx
    C:\TV Shows\MATH - Mathtype 5.2+Keygen.zip
    C:\Temp\Apllications\Mathtype<Delete the entire folder.
    C:\Documents and Settings\Mosheg\My Documents\Matlab\moshe\CircuitMaker +TraxMaker 2000.zip
    C:\Temp\Apllications\Circuit Maker 2000 SP1

    Reboot into normal mode and rehide your protected OS files.

    Post fresh HJT and AVG Antispyware logs.

    Regards Howard :wave: :wave:

    This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. vortexm

    vortexm TS Rookie Topic Starter

    thanx Howard,

    i followed the instructions but it seems ( from HJT) it didnt go away.
    i attach the logs as requested.

    Moshe
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Delete all files in AVG Antispyware quarantine.

    Go HERE and install one of the free firewall programmes.

    Then, run this Online scanner. You will need to use IE for this.

    Post the results of the above scan as well as a fresh HJT log.

    Regards Howard :)

    This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. vortexm

    vortexm TS Rookie Topic Starter

    Deleted the quarantined files on AVG.
    Downloaded zonealarm and it blocked 15 attempts to access from unknown IP.
    I attach reports as requested.

    Regards,
    Moshe
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    We need to temporarily disable Spybot search & Destroy`s tea time, as it may interfere with any fix we are trying to run.

    Disable Spybot's TeaTimer. This is a two step process.
    First:
    - Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
    - Choose Exit Spybot S&D Resident
    Second:
    - Open Spybot S&D
    - Click Mode, check Advanced Mode
    - Go To Left Panel, Click Tools, then also in left panel, click Resident
    - If your firewall raises a question, say OK
    - Uncheck the box labeled Resident Tea-Timer and OK any prompts.
    - Use File, Exit to terminate Spybot
    - Reboot your machine for the changes to take effect.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {6754A456-BAD9-11D4-93D3-00B0D03A2F91} - (no file)

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    Fix any O16 - DPF: entry you don`t recognise.

    O17 - HKLM\System\CCS\Services\Tcpip\..\{59CD7552-D75B-4796-8E28-12686F533D0E}: NameServer = 192.168.0.1

    O17 - HKLM\System\CCS\Services\Tcpip\..\{A7FA670C-EB32-418C-875E-9485D622C7B6}: NameServer = 212.117.129.5 212.116.161.38

    Only fix the above 017 entries if they doesn`t belong to your ISP.

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

    Click on the fix checked button.

    Close HJT and reboot your system. Re-enable spybot`s teatimer.

    Other than the above, your HJT log is clean.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. vortexm

    vortexm TS Rookie Topic Starter

    Hello again,

    I keep getting a message "language pack installation" pops up frequently. I dont see any proccess linked to it on 'Process explorer' and I think it has something to do with the previous problem. Every time it pops up I get an alert the firewall.

    Regards
    Moshe
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is clean.

    You`re running a completely unpatched version of Windows. You should run the Windows updates and install at least service pack 1 and preferably service pack 2.

    See if that cures your problem.

    Regards Howard :)

    This thread is for the use of vortexm only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...