TechSpot

Win32Klone/Dialer.BZB/Gen.WUE

By LHodge
Jul 4, 2006
  1. I booted in safe mode, disabled system restore, ran avg and deleted Dialer.BZB, Generic.WUE in temporary internet files folder and several win.tmp files in windows temp folder. Kaspersky detected Packed.Win32.Klone.g in the system32\winrkq32.dll file but avg did not. I rebooted in normal, enable system restore, ran avg and the viruses were detected again. I keep getting virus detected from avg (.tmp files from windows temp folder). Can someone please help. Thanks
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

    Fix all 016-DPF entries.

    Click on the fix checked button.

    Close HJT.

    Reboot into normal mode and turn system restore back on.

    Post a fresh HJT log.


    Regards Howard :wave: :wave:
     
  3. LHodge

    LHodge TS Rookie Topic Starter

    fresh hjt log

    heres a fresh log ..thank you
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Your HJT log is clean.

    Regards Howard :)
     
  5. LHodge

    LHodge TS Rookie Topic Starter

    Still having problems

    avg is still detecting same viruses:
    Content.IE5\EJ4R65SX\bgates[1].exe
    Content.IE5\UT8V4TOL\srveod[1].exe
    Content.IE5\UT8V4TOL\srvpsy[1].exe

    Heres an example of avg virus message i get every few minutes:
    Generic.WUE windows\temp\win38.tmp.exe
    Dialer.BZB windows\temp\win3b.tmp.exe

    I'll scan with ewido and send report when it finishes.
    Please let me know if theres anything else i can do.
    Thank you
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Thanks for the info, that`s quite useful.

    Download the Pocket killbox programme from HERE. Extract it, but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    win38.tmp.exe
    win3b.tmp.exe

    Close task manager.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

    These are the filepaths you need to enter into killbox.

    C:\windows\temp\win38.tmp.exe

    C:\windows\temp\win3b.tmp.exe

    Once your system has rebooted, turn system restore back on.

    See how your system runs.

    Regards Howard :)
     
  7. LHodge

    LHodge TS Rookie Topic Starter

    fresh hjt log

    Heres another fresh hjt log. I deleted the files several times but they are replaced by files of a similar names and more avg virus alerts.
    I did notice that SYSTEM32\winrkq32.dll is listed in this new log that was detected by Kaspersky as being infected..I dont know if this means anything though.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Download teh Cshredder programme from HERE. Make sure the programme is fully updated, then disconnect from the net.

    Then close every window, disconnect from Internet and doubleclick the CWShredder icon on your Desktop.
    Click Fix and then Next, let it fix everything it asks about.

    Then, please reboot.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

    O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB

    O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB

    O20 - Winlogon Notify: winrkq32 - C:\WINDOWS\SYSTEM32\winrkq32.dll

    Click on the fix checked button.

    Close HJT.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

    This is the filepath you need to enter into killbox.

    C:\WINDOWS\SYSTEM32\winrkq32.dll

    Once your system has rebooted, turn system restore back on and reconnect to the net.

    Post a fresh HJT log.

    Regards Howard :)
     
  9. LHodge

    LHodge TS Rookie Topic Starter

    Thank you

    Hi.. winrkq32.dll couldnt be deleted by killbox, should i try to delete on reboot?
    The good news is my virus vault has been clean since ive been on today about 2 hours and the last hour last night. And avg doesnt detect any viruses. I do appreciate the help.

    Libbie
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Yes you should use the delete file on reboot.

    Regards Howard :)
     
  11. LHodge

    LHodge TS Rookie Topic Starter

    Still having problems

    Spoke to soon just got an alert.
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Ok. run HJT and click on the config button, then the misc tools button. Click on the delete file on reboot button and browse to C:\WINDOWS\SYSTEM32\winrkq32.dll. Click on the winrkq32.dll and click open. You will be prompted to restart your computer, click yes.

    Once your computer has rebooted, post a fresh HJT log.

    Regards Howard :)
     
  13. LHodge

    LHodge TS Rookie Topic Starter

    Crossing fingers

    The file was deleted and hjt showed it as missing so i fixed that.

    Libbie
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Phew, that was stubborn.

    Anyway, your HJT log is now clean.

    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...