TechSpot

Virus found in important Windows File

By wolfsbabe
May 14, 2009
  1. I've got a problem. My computer has a trojan in it. I know what files they are but when they are put in Quarantine my internet is disabled. I restored them and once they were restored and restarted my computer my internet was fine again.

    The files were:

    c:\windows\system32\9446.exe (listed twice)

    and

    c:\windows\prefetch\9446.ex-25f69e40d.pf

    there was one other a temp file that was found also but I didn't restore it since the other two brought back my internet. I'm not sure what to do since those files appear to be infected but when they're removed my internet gives me problems. What do you recommend I do? is there a way to replace those files with non infected files?

    I'm also unable to check for virus definition updates (doesn't matter what virus program except for malware bytes is not affected) I can't check them. I'm wondering if those files above could be causing the problem?

    what do you recommend I do? malware bytes didn't even pick up those two files.
     
  2. soulslayer

    soulslayer TS Rookie Posts: 32

    I am not sure if this is possible, but I would need another member here to confirm this. My suggestion is to allow the files to remain quarantined and run a Windows repair from the Windows installation disc, which should replace any corrupted/changed/removed Windows files. What operating system are you using currently?
     
  3. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

  4. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    ok so put those files back in quarantine and then run the hickjack program and it should fix my internet? along with having the viruses gone?
     
  5. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    New Logs

    alright I requarantined the files after running the program again and ran hijack this. here are the logs for you. as of now that computer has no internet because of those quarantined files.

    malware log is in first attachment
     
  6. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    I recommend you uninstall your free AVG Antivirus
    Then run the removal tool
    Here is the 32Bit version (most users): http://www.avg.com/filedir/util/avg_arm_sup_____.dir/avgremover.exe
    Here is the 64Bit version: http://www.avg.com/filedir/util/avg_arv_sup_____.dir/avgremoverx64.exe

    An alternative Antivirus that I recommend is Avira free Antivirus (also being in the 8-Step guide)

    Confirm that it's updated: Manual Update is here: http://dl.antivir.de/down/vdf/ivdf_fusebundle_nt_en.zip

    Run a full scan

    Obviously you will need to transfer files (via USB Flash Drive or something?) if removing AVG still does not get you online. (after restart)
     
  7. soulslayer

    soulslayer TS Rookie Posts: 32

    @ kimsland: You are right. That particularly file is not one that would be replaced by a Windows repair. Also, I didn't know about the rules for virus and malware, until you brought it up. Thanks for letting me know.
     
  8. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    ya I've got a flash drive. thank god for those handy little things. I had Avira in my computer before and it wasn't able to update either. so I uninstalled it and tried avg to see if it would have a problem updating to and it did. I'll uninstall avg though and reinstall avira and manually update it and try a scan and see what happens. will let you know. do you want me to post a log after the avira scan to?
     
  9. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Definitely :grinthumb

    I like proving that AVG just doesn't find stuff :D

    Make sure Avira is updated
    And make sure that the AVG Removal Tool was run (its a must)
     
  10. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    Thanks I'll give you a try and let you know what happens. I'm going to start using firefox instead of explorer. my coworker said that explorer brings in all the viruses.
     
  11. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Actually Google Chrome is meant to be the best
    But I was a strong supporter for Internet Explorer,... actually you still need Internet Explorer to go to certain MS sites anyway.

    Anyway I slowly got converted to Firefox (annoyingly) :D
    I'm use to it now :)
     
  12. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    I won't remove it then and if google chrome is the best perhaps I'll try it. I don't like firefox much but if it means less viruses....well I'll live.

    question. I removed avg using the remover. reinstalled avira. i've got the update files on my flash drive. now what do I do with the update files? do I need to open them one by one or something or copy and paste into a certain avira file?
     
  13. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Well that manual update file is one file only, not files

    But ideally if you now have Internet access without AVG installed (and after restart) just right click on the icon and update online.

    If online update does not work still (which is very strange) then just open up Avira fully, click on "Update" on the top toolbar, then click "Manual Update" and then point it to the extracted update file (ideally unzipped to Desktop)

    Internet should work now anyway. AVG is gone :D
     
  14. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    oh ok. thanks let me give that a try and let you know what happens. my computer certainly shows that I've got signal just won't connect. lets see if that changed. will be back :)
     
  15. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    You better be quick, I'm tired :cool:
     
  16. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    the internet doesn't work and the manual update is giving me trouble. I go to look for the file and it doesn't show up. when I exacted the file I clicked on it, it wouldn't do anything. it would just go in and look for more files. what am I missing?
     
  17. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Hmm I've never clicked on it

    Maybe read above on how to update Avira manually ;)
    Sorry for being short, but it's all up there :grinthumb
     
  18. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    alright. thanks. I'll have to look again at it later. got to go now.

    alright. updated my avira manually. I redownloaded the update file and it worked just fine like it was supposed to with no extra clicks. I fully scanned my computer but no viruses and internet still doesn't work.

    I'm attaching the log for you to look at. There were two warning files that Avira was unable to scan.
     
  19. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    I think you said you had Wireless:

    Wireless Wizard
    Start->Run-> rundll32.exe shell32.dll,Control_RunDLL NetSetup.cpl,@0,WNSW
    Result: runs the Wireless Wizard

    Can you actually connect directly to the Modem?
    Also maybe disable Firewall. Also check Windows Firewall is disabled as well, in your Network Connections (you know, you have to right click on your connection etc etc etc)
     
  20. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    no I can't connect directly. to far away. but yes I have wireless. I'll try the wizard. If that doesn't work I'll try disabling the firewall. as to disabling the network I've tried repairing it and it usually gives me the yellow triagle icon with the ! point. but I'll try disabling it anyways to see if it makes a difference. I'll let you know if it works or not.
     
  21. wolfsbabe

    wolfsbabe TS Rookie Topic Starter Posts: 23

    no luck. why is it when those files were removed that they caused files? were they windows files or a virus coded to give internet problems once quarantined? Am I going to need to format? I'm avoiding that but if I have to do that then I'll do it.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...