I booted in safe mode, disabled system restore, ran avg and deleted Dialer.BZB, Generic.WUE in temporary internet files folder and several win.tmp files in windows temp folder. Kaspersky detected Packed.Win32.Klone.g in the system32\winrkq32.dll file but avg did not. I rebooted in normal, enable system restore, ran avg and the viruses were detected again. I keep getting virus detected from avg (.tmp files from windows temp folder). Can someone please help. Thanks
Win32Klone/Dialer.BZB/Gen.WUE
- Thread starter LHodge
- Start date
howard_hopkinso
Posts: 21,238 +17
Hello and welcome to Techspot.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
Fix all 016-DPF entries.
Click on the fix checked button.
Close HJT.
Reboot into normal mode and turn system restore back on.
Post a fresh HJT log.
Regards Howard :wave: :wave:
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
Fix all 016-DPF entries.
Click on the fix checked button.
Close HJT.
Reboot into normal mode and turn system restore back on.
Post a fresh HJT log.
Regards Howard :wave: :wave:
howard_hopkinso
Posts: 21,238 +17
Your HJT log is clean.
Regards Howard
Regards Howard
Still having problems
avg is still detecting same viruses:
Content.IE5\EJ4R65SX\bgates[1].exe
Content.IE5\UT8V4TOL\srveod[1].exe
Content.IE5\UT8V4TOL\srvpsy[1].exe
Heres an example of avg virus message i get every few minutes:
Generic.WUE windows\temp\win38.tmp.exe
Dialer.BZB windows\temp\win3b.tmp.exe
I'll scan with ewido and send report when it finishes.
Please let me know if theres anything else i can do.
Thank you
avg is still detecting same viruses:
Content.IE5\EJ4R65SX\bgates[1].exe
Content.IE5\UT8V4TOL\srveod[1].exe
Content.IE5\UT8V4TOL\srvpsy[1].exe
Heres an example of avg virus message i get every few minutes:
Generic.WUE windows\temp\win38.tmp.exe
Dialer.BZB windows\temp\win3b.tmp.exe
I'll scan with ewido and send report when it finishes.
Please let me know if theres anything else i can do.
Thank you
howard_hopkinso
Posts: 21,238 +17
Thanks for the info, that`s quite useful.
Download the Pocket killbox programme from HERE. Extract it, but don`t run it yet.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
win38.tmp.exe
win3b.tmp.exe
Close task manager.
Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.
These are the filepaths you need to enter into killbox.
C:\windows\temp\win38.tmp.exe
C:\windows\temp\win3b.tmp.exe
Once your system has rebooted, turn system restore back on.
See how your system runs.
Regards Howard
Download the Pocket killbox programme from HERE. Extract it, but don`t run it yet.
You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.
Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.
Click on the processes tab and end process for(if there).
win38.tmp.exe
win3b.tmp.exe
Close task manager.
Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.
These are the filepaths you need to enter into killbox.
C:\windows\temp\win38.tmp.exe
C:\windows\temp\win3b.tmp.exe
Once your system has rebooted, turn system restore back on.
See how your system runs.
Regards Howard
fresh hjt log
Heres another fresh hjt log. I deleted the files several times but they are replaced by files of a similar names and more avg virus alerts.
I did notice that SYSTEM32\winrkq32.dll is listed in this new log that was detected by Kaspersky as being infected..I dont know if this means anything though.
Heres another fresh hjt log. I deleted the files several times but they are replaced by files of a similar names and more avg virus alerts.
I did notice that SYSTEM32\winrkq32.dll is listed in this new log that was detected by Kaspersky as being infected..I dont know if this means anything though.
howard_hopkinso
Posts: 21,238 +17
Download teh Cshredder programme from HERE. Make sure the programme is fully updated, then disconnect from the net.
Then close every window, disconnect from Internet and doubleclick the CWShredder icon on your Desktop.
Click Fix and then Next, let it fix everything it asks about.
Then, please reboot.
Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O20 - Winlogon Notify: winrkq32 - C:\WINDOWS\SYSTEM32\winrkq32.dll
Click on the fix checked button.
Close HJT.
Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.
This is the filepath you need to enter into killbox.
C:\WINDOWS\SYSTEM32\winrkq32.dll
Once your system has rebooted, turn system restore back on and reconnect to the net.
Post a fresh HJT log.
Regards Howard
Then close every window, disconnect from Internet and doubleclick the CWShredder icon on your Desktop.
Click Fix and then Next, let it fix everything it asks about.
Then, please reboot.
Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html
Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html
In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html
Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O20 - Winlogon Notify: winrkq32 - C:\WINDOWS\SYSTEM32\winrkq32.dll
Click on the fix checked button.
Close HJT.
Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.
This is the filepath you need to enter into killbox.
C:\WINDOWS\SYSTEM32\winrkq32.dll
Once your system has rebooted, turn system restore back on and reconnect to the net.
Post a fresh HJT log.
Regards Howard
howard_hopkinso
Posts: 21,238 +17
Yes you should use the delete file on reboot.
Regards Howard
howard_hopkinso
Posts: 21,238 +17
Ok. run HJT and click on the config button, then the misc tools button. Click on the delete file on reboot button and browse to C:\WINDOWS\SYSTEM32\winrkq32.dll. Click on the winrkq32.dll and click open. You will be prompted to restart your computer, click yes.
Once your computer has rebooted, post a fresh HJT log.
Regards Howard
Once your computer has rebooted, post a fresh HJT log.
Regards Howard
howard_hopkinso
Posts: 21,238 +17
Phew, that was stubborn.
Anyway, your HJT log is now clean.
Regards Howard
Anyway, your HJT log is now clean.
Regards Howard
Latest posts
-
Trump warns Apple CEO Tim Cook against expanding iPhone assembly in India- scavengerspc replied
