What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis Log - Please Help

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
The log looks clean now.

Lets try this tool for getting rid of all the 'temp files'.

http://www.igorshpak.net/ <—System Security Suite

Download and install it - run it - put a check in ALL the boxes and hit clear.
That should get everything.

I see you are using the "BigFix".
If you're not using it anymore please uninstall it - if not leave it alone.

Let me know, MrC
Post #17
I’m attempting to get the computer into a state where I can complete a scan with Stinger, AdAware, Spybot, and AVG etc. but, as I mentioned before, something in C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet causes the machine to reboot. I went into IE (offline) and went to Tools > Internet Options > General tab. Under “Temporary Internet Files” I clicked “Delete Files…” and the clicked “OK”. Then I closed IE. Then in Windows Explorer I double clicked on C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet to list its content. It was empty except for a few *.ico files. Then I right clicked the folder and selected “Properties” and the computer crashed and rebooted. When the computer was up and running again, I rechecked the contents of C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet and all the original contents, that I thought I had deleted, was back. Conclusion: There is still some problem with C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet and this must be what is preventing me doing a scan with the aforementioned utilities. I must say, I think HijackThis is a remarkable tool. It has enabled me, with the expert help of MrCharlie, to clear out a load of trouble. I’m not knowledgeable enough to say it can help when all other methods fail, but it certainly seems like that. Now I’ve got so far, how do I proceed so that I can start using those other methods?
Post #19
I uninstalled BigFix. Then I ran 3s with all the IE temps etc. checked. It ran for few seconds and then computer crashed and rebooted. When up and running again I got the message “System has recovered from a serious error”. Then I fired up Windows Explorer and started manoeuvring to the C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet Files. WE crashed/rebooted the system when I got to the Local Setting part. I’m getting freighted my system will never get back to normal.
Post #20
Lets see if you can run this program, it will search your computer for any malware and give us a report. It takes a while so be patient.
If a box pops up why scanning to buy, just X it out.

Here it is:

http://www.mwti.net/antivirus/free_utilities.asp

Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.

Good luck and we'll get it!! MrC
Post #21
I downloaded Mwav.exe and ran it like you said. Several times while scanning my AVG popped up a “virus found” message and I X’ed it away. I watched which folders it was scanning until it got to “C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet Files” and then the computer crashed/rebooted. Just before that point it said it had found something like 50 viruses.
Post #22
See if you can do this - I want to clean up the registry.
Download and install RegCleaner 4.3.
http://www.worldstart.com/weekly-download/…-cleaner4.3.htm
It's a sfe program, I use it and never had any problems with it.
Just open it up, choose Tools, Reg Cleanup, Do them all.
Then select them all and delete them - a backup will be made.


Use ctrl - alt - delete and bring up task manager if you can and end task on everything running explorer and systray, you might even try this in safe mode. (I think you can run XP on just that - I don't run XP so I don't know - but shut down as much as possible).

Try deleting the contents of this folder:

C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet Files
Or open up IE, tools, etc.
Or try the SSS program again in safe mode.


Lets try this also:

This can also be caused by a corrupt temporary file. Clear the files from the Temp folder:

http://support.microsoft.com/default.aspx?…kb;en-us;823302

Close all applications
Start, click Run and type %temp% which opens the Temp folder
Type Ctrl+A to select all files
Press Delete
Close Windows Explorer
Open the Control Panel Internet Options applet
Select the General tab, then click Delete Files
Select the Delete all offline content check box
Click OK

Let me know, MrC
Post #23
Right – ran RegCleaner as instructed. Then I restarted XP in safe mode. I deleted contents of C:\Documents and Settings\Keith Waters\Local Settings\Temporary Internet Files. Also, I tried running sss but when I clicked “Clear Selected Items” it gave me “Access violation at address 0047616B in module ‘sss.exe’. Read of address 00000000” Still in safe mode, I then followed your remaining instruction to clear out the temp files. Then I restarted back to XP normal.
Post #24
I had some spare time today so I thought I’d try to zap this wretched infestation. First I ran sss with all boxes checked to clear out all temporary stuff. Then I ran the eScan AntiVirus Toolkit Utility (mWav.exe). I can post the log if that helps. Then I ran Stinger set to “Repair” on virus detection. The report is here: McAfee AVERT Stinger Version 2.4.7 built on Jan 3 2005 Copyright © 2004 Networks Associates Technology, Inc. All Rights Reserved. Virus data file v1000 created on Dec 14 2004. Ready to scan for 47 viruses, trojans and variants. Scan initiated on Mon Jan 10 11:27:15 2005 C:\WINDOWS\system32\c.bat Found the W32/Sdbot.bat.b virus !!! C:\WINDOWS\system32\c.bat has been deleted. C:\WINDOWS\system32\o Found the W32/Sdbot.worm!ftp virus !!! C:\WINDOWS\system32\o has been deleted. Number of clean files: 501244 Number of infected files: 2 Number of files deleted: 2 ———————————- Then I ran CleanMgr from Start > Run. It ran ok this time. Then I ran CWShredder. It said my computer had no CoolWebSearch infection. Then I ran AdAware. When it had vanished, I checked all critical objects it had found and then yes to cleaning. I can post the virus log if that helps. Then I ran SpyBot and it crashed/rebooted the computer part way though its scan. Then I ran AVG System Scan. It crashed/rebooted the computer while scanning the C:\Windows\system32\ folder. After computer had rebooted I ran Windows Explorer and it too now crashes/reboots machine when I attempt to access C:\Windows\system32\. After that I ran Mwav again and it crashed/rebooted machine. That’s as far as I’ve got. I hope I didn’t do anything I shouldn’t have done that is causing these crashes. While posting this message I’ve just noticed that I’m still getting bopup messages in IE. This virus infection and associated crashing/rebooting problem is refusing to go away. I’m beginning to despair.
Post #25
Hang in there, we're making progress.

Then I ran the eScan AntiVirus Toolkit Utility (mWav.exe). I can post the log if that helps.


Yes post that log, that will give us all the bad files. MrC
Post #26
Herewith the eScan log. The fact that I cannot run dos programs (I believe I mentioned it before) still bothers me. Today I went to Start > Run and entered COMMAND. This should have invoked command.com to give me a dos prompt, yes, but instead I got a message “Attempt to access invalid address”. This means command.com is corrupted doesn’t it? ****************************************************** eScan AntiVirus Toolkit Utility (mWav.exe): ****************************************************** File C:\WINDOWS\System32\navprotect.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\smsss.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\smsss.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\navprotect.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\dalin.exe infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\msxmidi.exe infected by "Backdoor.Win32.Haxdoor.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\c.bat infected by "Trojan-Downloader.BAT.Ftp.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\ESOWF.dll infected by "Backdoor.Win32.Haxdoor.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exdl.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exul.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\exul1.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken. File C:\WINDOWS\System32\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\KILLAPPS.EXE tagged as not-a-virus:RiskWare.Tool.KillApp.b. No Action Taken. File C:\WINDOWS\System32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\mediaplayer.exe infected by "TrojanDropper.Win32.Juntador.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\o infected by "Trojan-Downloader.BAT.Ftp.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\tmpf04.exe infected by "Backdoor.Win32.Haxdoor.az" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\tmpf06.exe infected by "Backdoor.Win32.Haxdoor.az" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\windupdates.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\!Submit\aRMlpbBvH.exe infected by "not-a-virus:AdWare.WinFetcher.c" Virus. Action Taken: No Action Taken. File C:\!Submit\bargains.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\!Submit\crsss.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\!Submit\DeskAdKeep.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken. File C:\!Submit\navprotect.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\!Submit\salm.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\!Submit\systemupdate.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\!Submit\WebRebates0.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\!Submit\WebRebates1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\!Submit\WinServAd.exe infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\!Submit\WinServSuit.exe infected by "not-a-virus:AdWare.WinAD.h" Virus. Action Taken: No Action Taken. File C:\!Submit\zeta.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K49QEKAP\bunSetup[1].cab infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\HighjackThis\backups\backup-20050108-121417-120.dll infected by "not-a-virus:AdWare.Relevance.b" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\HighjackThis\backups\backup-20050108-152423-484.dll infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\aRMlpbBvH.exe infected by "not-a-virus:AdWare.WinFetcher.c" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\crsss.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\navprotect.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\salm.exe infected by "not-a-virus:AdWare.180Solutions" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\systemupdate.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\WebRebates0.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\WebRebates1.exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\WinServAd.exe infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\Downloads\Anti-Parasite\KillBox\WinServSuit.exe infected by "not-a-virus:AdWare.WinAD.h" Virus. Action Taken: No Action Taken. File C:\Downloads\IomegaWin98\ioware-w32-x86-402.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\My Downloads\Iomega\ioware-w32-x86-402.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\DIALERS\SexPress - UK.EXE tagged as not-a-virus:Porn-Dialer.Win32.Frelex. No Action Taken. File C:\MyDisk\Downloads\Copy (2) of PBCC2\setupcc.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\Copy (2) of PBDLL6\setupdll.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\Copy of PBCC2\setupcc.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\Copy of PBDLL6\setupdll.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\NO1\Config.sys tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken. File C:\MyDisk\Downloads\NO1\freedownload.exe tagged as not-a-virus:Porn-Dialer.Win32.Generic. No Action Taken. File C:\MyDisk\Downloads\PBCC2\setupcc.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\PBDLL6\setupdll.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\PBUPGR~1\setupcc.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\Downloads\PBUPGR~1\setupdll.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\JDK12~1.2\DEMO\APPLETS\BARCHART\Chart.class tagged as not-a-virus:JavaClass.Chart. No Action Taken. File C:\MyDisk\LOSTFILE\DIR171\AOL\AOL40US.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\MYDOWN~1\USERS\DEFAULT\MAIL\Inbox infected by "Macro.Word97.Marker.q" Virus. Action Taken: No Action Taken. File C:\MyDisk\MYDOWN~1\USERS\DEFAULT\MAIL\Sent infected by "Macro.Word97.Marker.q" Virus. Action Taken: No Action Taken. File C:\MyDisk\PROGRA~1\ONLINE~1\AT&T\ATTSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\MyDisk\WIN32API\WIN32API.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\program files\Iomega\AutoDisk\Setup_enu.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\program files\Iomega\DriveIcons\imghr.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\program files\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\RECYCLER\askjhfs3.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\RECYCLER\jhfhjj.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\trots.exe infected by "TrojanDropper.Win32.PurityScan.h" Virus. Action Taken: No Action Taken. File C:\WINDOWS\dalin.exe infected by "not-a-virus:AdWare.WinAD.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ringtone.exe tagged as not-a-virus:RiskWare.Dialer.PlayGames. No Action Taken. File C:\WINDOWS\Downloaded Program Files\CONFLICT.2\ringtone.exe tagged as not-a-virus:RiskWare.Dialer.PlayGames. No Action Taken. File C:\WINDOWS\Downloaded Program Files\lsp_.dll infected by "not-a-virus:AdWare.Sahat.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\ringtone.exe tagged as not-a-virus:RiskWare.Dialer.PlayGames. No Action Taken. File C:\WINDOWS\msxmidi.exe infected by "Backdoor.Win32.Haxdoor.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\angelex.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\c.bat infected by "Trojan-Downloader.BAT.Ftp.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8TMV58AJ\istdownload[1].exe infected by "Trojan-Downloader.Win32.IstBar.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\DF7ZLTIR\DLC[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\DF7ZLTIR\targetsaver[1].exe infected by "TrojanDownloader.Win32.TSUpdate.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J20ZYTGA\data[1].exe infected by "TrojanDropper.Win32.Juntador.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J20ZYTGA\DTBC[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J20ZYTGA\webrebates_europe[1].exe infected by "not-a-virus:AdWare.WebRebates.d" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\P8UJHVWL\data[1].exe infected by "TrojanDropper.Win32.Juntador.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\ESOWF.dll infected by "Backdoor.Win32.Haxdoor.ay" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl0.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exdl1.exe infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\exul1.exe infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken. File C:\WINDOWS\system32\javexulm.vxd infected by "not-a-virus:AdWare.BargainBuddy.q" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\KILLAPPS.EXE tagged as not-a-virus:RiskWare.Tool.KillApp.b. No Action Taken. File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mediaplayer.exe infected by "TrojanDropper.Win32.Juntador.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mqexdlm.srg infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\o infected by "Trojan-Downloader.BAT.Ftp.c" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\tmpf04.exe infected by "Backdoor.Win32.Haxdoor.az" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\tmpf06.exe infected by "Backdoor.Win32.Haxdoor.az" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\windupdates.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\ov.exe infected by "not-a-virus:AdWare.WinFetcher.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\t.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\WinWildApp.exe infected by "not-a-virus:AdWare.WinFetcher.b" Virus. Action Taken: No Action Taken. File C:\Zips\Backup Disk #2\Downloads1.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Zips\Backup Disk #3\My Downloads.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Zips\MyDisk1.zip tagged as not-a-virus:Porn-Dialer.Win32.Frelex. No Action Taken. File C:\Zips\MyDisk2.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Zips\Program files.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. ————————————————————————————————————–
Post #27
OK, these are all the viruses and malware on the system. (there may be some duplicates in there)

This is the only one I'm not sure of:

KILLAPPS.EXE File C:\WINDOWS\system32\KILLAPPS.EXE

Do you have the program KillApps on the system, if not delete this one also.

The rest have to be deleted, reboot into safe mode, bring up your task manager and shut down as much as you can - use the KillBox - copy and paste each one in and hit delete.
Try to keep track of which ones you delete.
After doing this, try running the some of the on-line virus scanners in my first post - also run AdAware and Spybot again. Good Luck!!! MrC Let Me Know

C:\WINDOWS\System32\navprotect.exe
C:\WINDOWS\System32\smsss.exe
C:\WINDOWS\msxmidi.exe
C:\WINDOWS\dalin.exe
C:\WINDOWS\System32\angelex.exe
C:\WINDOWS\System32\c.bat
C:\WINDOWS\System32\ESOWF.dll
C:\WINDOWS\System32\exdl.exe
C:\WINDOWS\System32\exdl0.exe
C:\WINDOWS\System32\exdl1.exe
C:\WINDOWS\System32\exul.exe
C:\WINDOWS\System32\exul1.exe
C:\WINDOWS\System32\javexulm.vxd
C:\WINDOWS\System32\mac80ex.idf
C:\WINDOWS\System32\mediaplayer.exe
C:\WINDOWS\System32\mqexdlm.srg
C:\WINDOWS\System32\netut80ex.vxd
C:\WINDOWS\System32\o
C:\WINDOWS\System32\tmpf04.exe
C:\WINDOWS\System32\tmpf06.exe
C:\WINDOWS\System32\windupdates.exe
C:\MyDisk\DIALERS\SexPress - UK.EXE
C:\MyDisk\Downloads\NO1\Config.sys
C:\MyDisk\Downloads\NO1\freedownload.exe
C:\RECYCLER\askjhfs3.exe
C:\RECYCLER\jhfhjj.exe
C:\WINDOWS\dalin.exe
C:\WINDOWS\Downloaded Program Files\lsp_.dll
C:\WINDOWS\msxmidi.exe
C:\WINDOWS\system32\angelex.exe
C:\WINDOWS\system32\c.bat
C:\WINDOWS\system32\ESOWF.dll
C:\WINDOWS\system32\exdl.exe
C:\WINDOWS\system32\exdl0.exe
C:\WINDOWS\system32\exdl1.exe
C:\WINDOWS\system32\exul.exe
C:\WINDOWS\system32\exul1.exe
C:\WINDOWS\system32\instsrv.exe
C:\WINDOWS\system32\mediaplayer.exe
C:\WINDOWS\system32\mqexdlm.srg
C:\WINDOWS\system32\netut80ex.vxd
C:\WINDOWS\system32\o
C:\WINDOWS\system32\tmpf04.exe
C:\WINDOWS\system32\tmpf06.exe
C:\WINDOWS\system32\windupdates.exe
C:\WINDOWS\Temp\ov.exe
C:\WINDOWS\Temp\t.exe
C:\WINDOWS\Temp\WinWildApp.exe

I don't know what these are - check them out:

C:\WINDOWS\Downloaded Program Files\ringtone.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\ringtone.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\ringtone.exe

These you'll have to sort through:
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\K49QEKAP\bunSetup[1].cab
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8TMV58AJ\istdownload[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\DF7ZLTIR\DLC[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\DF7ZLTIR\targetsaver[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J20ZYTGA\data[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J20ZYTGA\DTBC[1].exe
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\J20ZYTGA\webrebates_europe[1].exe

C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\P8UJHVWL\data[1].exe
File C:\MyDisk\MYDOWN~1\USERS\DEFAULT\MAIL\Inbox infected by "Macro.Word97.Marker.q"

File C:\MyDisk\MYDOWN~1\USERS\DEFAULT\MAIL\Sent infected by "Macro.Word97.Marker.q"
Post #28
I went into safe mode and deleted all the virus and malware files including the killapps.exe. Only one file gave trouble, C:\windows\system32\ESOWF.dll, which KillBox could not delete. In fact, when I attempted to delete it the SafeMode task bar and desktop disappeared. I don’t know if this helps, but the following processes (as listed by KillBox) were active. System smss.exe csrss.exe winlogon.exe services.exe lsass.exe svchost.exe svchost.exe explorer.exe notepad.exe killbox.exe Then I tried two of the online scanners without success. Housecall took ages and ages and gave me no feedback as to what was happening. As there seemed to be nothing happening I tried Panda Active Scan. This is a much nicer web site that gave feedback. After it had loaded, I selected Disinfect automatically and clicked “All my computer”. It sat there apparently doing nothing for ages and said “Error on page” in lower left corner. So, sad to say the progress with the online scanners is zero. IE still has stupid popups and is slow. Then I ran AdAware and removed the one critical object found which was a tracking cookie. That’s as far as I’ve got. I’ll have a go with SpyBot and AVG tomorrow.
Post #30
I forgot to tell you that the KillBox creates a folder in C:\ called !Submit, please delete the whole folder.
This is where all the backups of the files you deleted ae kept.
Then empty the recycle bin. MrC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI