TechSpot

When Viruses Attack!

By profwagstaff
Jun 30, 2006
  1. Hey guys,
    I've got some pretty bad viruses going on here. I have AVG VirusGuard and it keeps popping up saying that it's found something (TrojanDialer.BZB) and asking if I want to heal it. Then it heals it. But five minutes later it says that it's found it again. And again. And again.
    I've run a lot of different programs and it keeps happening. What to do now?
    I've attached my HJT file.
    Thanks in advance!
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Your system is infected with quite a few nasties.

    Go HERE and follow the instructions exactly.

    Post a fresh HJT log into this thread, only after doing the above.

    Regards Howard :wave: :wave:
     
  3. fastco

    fastco TS Booster Posts: 1,122

    Howard you beat me to it..You the Man!!!!!
     
  4. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    Ok, I think I hit all of the steps. There were a lot of 'em hidden away, though, so I may have missed one or two.
    But new problem: I can't attach anything here. Why would that be?
    That means that I can't attach my HJT list. I hit the Manage Attachments button and nothing happens. Is there a setting that got reset? Am I stupid?
    Thanks.
     
  5. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Right click on your HJT log and select rename. Click in the title box and type .txt and hit the enter key.

    You should now be able to attach the file.

    The reason you need to do this is because HJT log files have a .log extension and not a .txt extension.

    Regards Howard :)
     
  6. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    I couldn't even get to that step. There's something blocking me from even getting to the window where I enter what file I want to attach. I click on the "Manage Attachments" button and nothing comes up at all.
    Of course, I was only trying it on Firefox (which worked before), but I didn't try IE. It was really late and I had about half an eye open.
    I'm not near that computer right now, but I'll try IE later. Maybe that'll work.
    Any suggestions on why Firefox wasn't working? All of the other buttons worked but that one. It's probably a pop-up blocker, but the ctrl button wasn't disabling it. (I was awake enough to try that.)
     
  7. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Ok. since you are having trouble, just copy and paste the HJT log into this thread.

    Regards Howard :)
     
  8. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    Ok. I was able to do it in IE. So here it is.
    Thanks.
     
  9. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    5b3291f1.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKCU\..\Run: [5b3291f1.exe] C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

    O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123

    O17 - HKLM\System\CCS\Services\Tcpip\..\{00CDACEB-0117-4A8C-9DDA-04259520A72D}: NameServer = 4.2.2.1,4.2.2.2
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D439DD-892B-4202-ADA9-85A158BDF317}: NameServer = 4.2.2.1,4.2.2.2
    O17 - HKLM\System\CS1\Services\Tcpip\..\{00CDACEB-0117-4A8C-9DDA-04259520A72D}: NameServer = 4.2.2.1,4.2.2.2
    O17 - HKLM\System\CS2\Services\Tcpip\..\{00CDACEB-0117-4A8C-9DDA-04259520A72D}: NameServer = 4.2.2.1,4.2.2.2

    Only fix the above 017 entries, if they don`t belong to your ISP.

    O20 - Winlogon Notify: winwsa32 - winwsa32.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

    Reboot into normal mode and turn system restore back on.


    Regards Howard :)
     
  10. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    AWESOME! Thanks, Howard.
    I think that cleared most of it up. I got a warning from AVG saying that it found something like "Generic.WUA" just after I rebooted after doing all of that. I haven't gotten it since, so maybe it actually took care of it this time.
    Thanks again, and if I have any more problems, I'll let you know.

    --Mark
     
  11. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    Ok, so, of course I keep hitting more snags. I think (maybe) the viruses are gone, but my system is moving REALLY slowly now and, while I'm using utorrent (something I'm sure everyone here will advise me against, I know), my internet connection is screwed for anything else.
    I know I didn't get this virus from downloading torrents (yes, I know EXACTLY what it was I did to get it), so I still feel sort of safe using utorrent. But what's going on with the connection? I've never seen it do this before.
    Thanks.
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Just to be on the safe side, please post a fresh HJT log.

    Regards Howard :)
     
  13. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    Here 'tis.
    Happy 4th!
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Bugger, the bloody thing has regenerated.

    Download the Pocket killbox programme from HERE. Extract it, but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    5b3291f1.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKLM\..\Run: [5b3291f1.exe] C:\WINDOWS\system32\5b3291f1.exe

    O4 - HKCU\..\Run: [5b3291f1.exe] C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

    Click on the fix checked button.

    Close HJT.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

    These are the filepaths you need to enter into killbox.

    C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

    C:\WINDOWS\system32\5b3291f1.exe

    Once your system has rebooted, turn on system restore and post a fresh HJT log.

    Regards Howard :)
     
  15. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    Ok. Done. I don't see the file anymore, but I didn't see it in the system32 folder when I was using Killbox. Hopefully it's gone, though.
    Thanks.
     
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Excellent, your HJT log is clean.

    Regards Howard :)
     
  17. profwagstaff

    profwagstaff TS Rookie Topic Starter Posts: 20

    Awesome! Thanks a lot, Howard.
    utorrent is still bogging things down like never before. I can't do anything web based while I have utorrent open. Any ideas? Should I just reinstall utorrent and see if that does it? Because this wasn't happening pre-virus.
     
  18. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Yes try a reinstall and see if it helps.

    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...