Computer infected with virus.

[Elro]

I've been postponing posting this, in hopes that perhaps the demons in my computer might miraculously eat each other (or other such luck), but it seems to be only getting worse. A few weeks ago I stupidly clicked on a suspicious file... It is a bad feeling to click on a suspicious file and have nothing happen. It is a worse feeling to realize shortly thereafter that said file deleted itself.

Since then, I've been getting strange VirusScan alerts (bgates.exe, Generic Downloader.ab, QZones15, and other fun stuff), as well as having suspicious programs running in the background (ishost.exe? ismon.exe? motivebrowser.exe? And cool.exe, which periodically restarts itself after having its task ended). End result: noticeable slowing down of the computer and internet connection, and unusual activity which is starting to make me nervous.

So, without further adieu, my HJT log. I wasn't sure if it had to be run under special conditions, so I didn't. If you need me to run HJT under special conditions, just let me know.

(Edit: Looks like motivebrowser.exe might be related to BellSouth, my internet provider, I just didn't recall it being installed.)

 

[Elro]

I can if necessary, but I'd like to try to clean it first.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Forget the above advice, it`s just plain wrong.

Guys, I`m not being funny or anything, but if you don`t know how to analyse HJT logs, please don`t reply. Please read THIS.

Elro: Please do the following.

Download the Pocket Killbox programme from HERE. Extract it, but don`t run it yet.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

cool.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O20 - Winlogon Notify: winjyg32 - C:\WINDOWS\SYSTEM32\winjyg32.dll

Click on the fix checked button.

Close HJT.

Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

These are the filepathes you need to enter into killbox.

C:\WINDOWS\SYSTEM32\winjyg32.dll

C:\WINDOWS\system32\cool.exe

Once your system has rebooted, turn system restore back on.

Post a fresh HJT log and let me know how your system is running.

Regards Howard :wave: :wave:

This thread is for the use of Elro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Elro]

Cool, it appears to have killed cool.exe (temporarily, at least). Unfortunately, though, it seemed to have had a slight hiccup with winjyg32.dll. I fixed it in HJT... But then when I tried to use Killbox on it, it said "File Could not be Deleted." Furthermore, each time I tried (for I tried thrice), it seemed to bring Explorer to its death throes. The Start Menu, taskbar, and desktop went blank, leaving only the Safe Mode labels... I had to log out and back in to get those things back each time.

So I decided to give in for the moment. The other problem is, when I restarted normally, winjyg32.dll was back in the HJT queue. Also, I still get ishost.exe and ismon.exe on Startup. Maybe they're dependent on the DLL, or maybe you didn't notice them because I ended their tasks before I scanned with HJT, but this time I left them up.

(Wow, that's a lot of jargon.)

I scanned twice with HJT: once at the point that you told me to do so, and once later when I restarted normally, after re-enabling System Restore. Both are attached.

 

[howard_hopkinso]

You have nasties on your system, that weren`t in your first HJT log.

Download and run these three tools. Follow the instructions for each tool.

Tool1. Tool2. Tool3.

Post a fresh HJT log from normal mode, only after doing the above.

Regards Howard

This thread is for the use of Elro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Elro]

Progress

OK. Looks like ishost.exe and ismon.exe might be dead now. Unfortunately, the DLL still won't die, and cool.exe is back. In fact, it re-emerged its scrawny head before I even ran those three tools, so I killed it again. Now it appears to be back again. It's like a monster from a really cheesy horror film series that keeps making sequels.

I will say this, though: the computer seems to be running slightly faster with the is*.exe's dead.

Any more ideas on how to deal with the uncool program? I've attached the most recent HJT log...

Also, I discovered a directory (care of KillBox probably) called "!Kill" in the core directory. It seems to be where it relocates its corpses. Can I kill it? Please? I'll wait until after everything is resolved if necessary, but I don't want that garbage left on my system in any form.

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

Cool.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O20 - Winlogon Notify: winjyg32 - C:\WINDOWS\SYSTEM32\winjyg32.dll

Click on the fix checked button.

Close HJT.

Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

This is the filepath you need to enter into killbox.

C:\WINDOWS\SYSTEM32\winjyg32.dll

Also, enter the file path for cool.exe if it`s still there. C:\WINDOWS\system32\cool.exe


Once your system has rebooted, turn system restore back on.

Post a fresh HJT log.

And whatever you do, stop trying to fix things on your own. It just makes it harder work for both of us lol.

Do not delete the !kill file yet.

Regards Howard

This thread is for the use of Elro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Elro]

"When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button."

Whoops, I managed to miss this somehow the first time, despite its boldness.

I've done all that you said, and given cool.exe time to reappear. It seems that my computer may no longer have Trojans or viruses on it. Thanks a lot for your help.

Is it okay to kill !Kill now?

(I'm posting the HJT log just in case, but I do think the system is clean.)

 

[howard_hopkinso]

Have HJT fix the following inactive entry.

O20 - Winlogon Notify: winjyg32 - winjyg32.dll (file missing)

Other than that, your HJT log is clean.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of Elro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.