Win-eto.com/t.swapx.cc Hijack

mwavscan complete:
Only THREE! Wow. From 262 down to 3. That's amazing!!

File C:\System Volume Information\_restore{FB32A4D8-7A80-4204-BFD5-823A67FB9529}\RP2\A0000060.exe infected by "TrojanDownloader.Win32.WinShow.am" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{FB32A4D8-7A80-4204-BFD5-823A67FB9529}\RP2\A0000061.exe infected by "TrojanClicker.Win32.Small.bg" Virus. Action Taken: No Action Taken.
File C:\System Volume Information\_restore{FB32A4D8-7A80-4204-BFD5-823A67FB9529}\RP2\A0000062.exe infected by "TrojanDownloader.Win32.WinShow.r" Virus. Action Taken: No Action Taken.

I'm gonna guess you want me to do a KillBox on these three, but I'll wait to hear from you.
Still having the OLEPRO32.DLL problem. No iTunes, QuickTime or Java.

For a good free firewall go here:

http://www.zonelabs.com/store/content/cata….jsp?lid=nav_za

Also, go here here to download the free version of Emsisoft's a2 AntiTrojan program.

Did you do this:

1. Right-click My Computer>Click Properties>Click the System Restore tab>Check the box next to 'Turn off System Restore on all drives'>Click Apply>Click OK.

2. Reboot.

3. Repeat the process but this time remove the check from the box.

That will get rid of the three remaining.

A little confused. Do I need to KillBox the 3 items first, then do the System Restore stuff? Please let me know about this in case I'm reading this wrong. I did the system restore somewhere on page 3 I believe and then set it back, but not since we've been down to 3. Thanks for the software links!

You don't need to Killbox them first. This path:

C:\System Volume Information\_restore

in each of the entries indicates that the virus is contained within the system restore point - purging it as I described is all that is needed.

To register that file, click Start, Run and type cmd. Press OK.

A DOS window will open.

Type the following and then press Enter

regsvr32 OLEPRO32.DLL

Are you noticing any improvement in the system yet?

Hey D Rock, I did the purge you suggested, though I have not had a chance to run another mwavscan…but I believe in ya. Which reminds me, to go set it back now. Yes, very much so, my system is 99.9% back to normal…other than the BIOS screen which I hope to have solved within the next day or so. Speed is great. Zone Alarm & AVG are great & a2 found 1 malware and removed it. As for my OLEPRO32 file, still no luck. My DOS prompt shows this: C:\Documents and Settings\Phantom> I typed it like this: C:\Documents and Settings\Phantom>regsvr32 OLEPRO32.DLL should I add a ">" or "\" in there?

You just need to type at the prompt: regsvr32 OLEPRO32.DLL nothing else, then hit enter.

Hmm…still a no go: RegSvr32 "OLEPRO32.DLL" is not an executable file and no registration helper is registered for this file type. I actually did this correct the first time, but I typed it out wrong in my explanation. Is there anywhere else I could get the file from?

Let me look into it a bit more - have you contacted Tech Support at itunes or QuickTime?

I have not contacted tech support at iTunes/QuickTime. I'll see what I can do with my BIOS and with Apple and report back this afternoon. I gotta get to bed. I'll look for ya in about 12 hours. Edit: Does "DDE Server Window" mean anything? How about "Error #-2093"??

See this:

http://www.taltech.com/TALtech_web/support…sw/ddeunder.htm

The error number is not familiar to me - I will continue to look into it

Hey Daemon, Sorry I've been away…it was finals week. Here's the latest: I was able to fix my BIOS screen, all I had to do was set floppy to disable…somehow it was set to enabled. The floppy is not even in the bay. I posted on the Apple board about my iTunes/QuickTime problem, but no reply yet. I don't think I fully understand the article you posted, though I kinda get the idea. I kinda took it as some other computer was trying to control mine? Maybe I'm waaay off there. Oh, the !Submit folder reappeared in my C drive, so I deleted it. I noticed this when I was sending some D drive files back to my C drive. I also uninstalled SP2 and installed 2 Sony updates then re-installed SP2. That's what their service tech told me to do. Whatever. It's all there now. That's all for now.

Hey Daemon, !Submit folder continues to reappear, though my computer is running smooth minus the few applications I'd like to run. I still have no iTunes, QuickTime, or Java, and it appears the only way to get them back is to perform a system recovery, which I cannot afford to do at this time. I'm hoping Santa brings me a external hard drive so I can transfer files and then do the SR, if not it could be some time before I do that. Other than that, I think the case is closed on this one. Thanks again for all of your help cleaning up my PC.

Hi there

I'm sorry that we never figured out what the problem was with those applications - everything I researched came up with zip. Anyway we got all the bad boys off your system. The !Submit folder is harmless - it's just where killbox dumps the files it removes.

Have a good Christmas and New Year.


As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.