When Viruses Attack!

P

profwagstaff

Posts: 20   +0
Hey guys,
I've got some pretty bad viruses going on here. I have AVG VirusGuard and it keeps popping up saying that it's found something (TrojanDialer.BZB) and asking if I want to heal it. Then it heals it. But five minutes later it says that it's found it again. And again. And again.
I've run a lot of different programs and it keeps happening. What to do now?
I've attached my HJT file.
Thanks in advance!
 
Hello and welcome to Techspot.

Your system is infected with quite a few nasties.

Go HERE and follow the instructions exactly.

Post a fresh HJT log into this thread, only after doing the above.

Regards Howard :wave: :wave:
 
Ok, I think I hit all of the steps. There were a lot of 'em hidden away, though, so I may have missed one or two.
But new problem: I can't attach anything here. Why would that be?
That means that I can't attach my HJT list. I hit the Manage Attachments button and nothing happens. Is there a setting that got reset? Am I stupid?
Thanks.
 
Right click on your HJT log and select rename. Click in the title box and type .txt and hit the enter key.

You should now be able to attach the file.

The reason you need to do this is because HJT log files have a .log extension and not a .txt extension.

Regards Howard :)
 
I couldn't even get to that step. There's something blocking me from even getting to the window where I enter what file I want to attach. I click on the "Manage Attachments" button and nothing comes up at all.
Of course, I was only trying it on Firefox (which worked before), but I didn't try IE. It was really late and I had about half an eye open.
I'm not near that computer right now, but I'll try IE later. Maybe that'll work.
Any suggestions on why Firefox wasn't working? All of the other buttons worked but that one. It's probably a pop-up blocker, but the ctrl button wasn't disabling it. (I was awake enough to try that.)
 
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

5b3291f1.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKCU\..\Run: [5b3291f1.exe] C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1123

O17 - HKLM\System\CCS\Services\Tcpip\..\{00CDACEB-0117-4A8C-9DDA-04259520A72D}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2D439DD-892B-4202-ADA9-85A158BDF317}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{00CDACEB-0117-4A8C-9DDA-04259520A72D}: NameServer = 4.2.2.1,4.2.2.2
O17 - HKLM\System\CS2\Services\Tcpip\..\{00CDACEB-0117-4A8C-9DDA-04259520A72D}: NameServer = 4.2.2.1,4.2.2.2

Only fix the above 017 entries, if they don`t belong to your ISP.

O20 - Winlogon Notify: winwsa32 - winwsa32.dll (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

Reboot into normal mode and turn system restore back on.


Regards Howard :)
 
AWESOME! Thanks, Howard.
I think that cleared most of it up. I got a warning from AVG saying that it found something like "Generic.WUA" just after I rebooted after doing all of that. I haven't gotten it since, so maybe it actually took care of it this time.
Thanks again, and if I have any more problems, I'll let you know.

--Mark
 
Ok, so, of course I keep hitting more snags. I think (maybe) the viruses are gone, but my system is moving REALLY slowly now and, while I'm using utorrent (something I'm sure everyone here will advise me against, I know), my internet connection is screwed for anything else.
I know I didn't get this virus from downloading torrents (yes, I know EXACTLY what it was I did to get it), so I still feel sort of safe using utorrent. But what's going on with the connection? I've never seen it do this before.
Thanks.
 
Bugger, the bloody thing has regenerated.

Download the Pocket killbox programme from HERE. Extract it, but don`t run it yet.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

5b3291f1.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [5b3291f1.exe] C:\WINDOWS\system32\5b3291f1.exe

O4 - HKCU\..\Run: [5b3291f1.exe] C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

Click on the fix checked button.

Close HJT.

Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

These are the filepaths you need to enter into killbox.

C:\Documents and Settings\nx7000\Local Settings\Application Data\5b3291f1.exe

C:\WINDOWS\system32\5b3291f1.exe

Once your system has rebooted, turn on system restore and post a fresh HJT log.

Regards Howard :)
 
Ok. Done. I don't see the file anymore, but I didn't see it in the system32 folder when I was using Killbox. Hopefully it's gone, though.
Thanks.
 
Awesome! Thanks a lot, Howard.
utorrent is still bogging things down like never before. I can't do anything web based while I have utorrent open. Any ideas? Should I just reinstall utorrent and see if that does it? Because this wasn't happening pre-virus.
 
profwagstaff said:
Awesome! Thanks a lot, Howard.
utorrent is still bogging things down like never before. I can't do anything web based while I have utorrent open. Any ideas? Should I just reinstall utorrent and see if that does it? Because this wasn't happening pre-virus.
Click to expand...

Yes try a reinstall and see if it helps.

Regards Howard :)
 

Similar threads

R
Solved Norton blocked attack by: System Infected: Miner.Bitcoinminer Activity #
2
Replies
32
Views
5K
Broni
Broni
LinzReid
TrojanDownloader.JS/swabfex.P
Replies
1
Views
652
LinzReid
LinzReid
midian182
Meta maintains a secret "do-not-rehire" list for ex-employees
2
Replies
31
Views
462
ZedRM
ZedRM

Latest posts

Back