What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

About Blank

52 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
So just turn off system restore and reboot, and the files will be deleted? No further manual deletion required? If so, just rescan and post? Thanks, Tim
Post #33
MrC, Sorry for the mess-up. I think I'm going to need some help with this Restore Point proceedure. It's seems to be a mental block for me. Anyway, here is the refined log. I did not do anything before the scan except turn off system restore and reboot as instructed. Thanks. File C:\WINDOWS\crwo.exe infected by "Backdoor.Win32.Small.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\n_iprbok.log infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wolngeoj.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mqexdlm.srg infected by "not-a-virus:AdWare.ToolBar.Exact" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.ToolBar.Exact" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\SahHtml.exe infected by "not-a-virus:AdWare.Sahat.i" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\TIMS~1\LOCALS~1\TEMPOR~1\Content.IE5\QK4FPH8L\masta[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DyFuCAInternetOptimizer2.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy16.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy32.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy35.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Tim S\Local Settings\Temporary Internet Files\Content.IE5\QK4FPH8L\masta[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Tim S\My Documents\hijack.exe\backups\backup-20050203-101816-577.dll infected by "Trojan-Downloader.Win32.IstBar.gu" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Tim S\My Documents\hijack.exe\backups\backup-20050203-101816-988.dll infected by "not-a-virus:AdWare.WinAD.t" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Tim S\My Documents\hijack.exe\backups\backup-20050203-122108-884.dll infected by "not-a-virus:AdWare.WinAD.t" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Tim S\My Documents\hijack.exe\backups\backup-20050203-122109-562.dll infected by "Trojan-Downloader.Win32.IstBar.gu" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\Tim S\My Documents\Kaza\kmd160_en.exe infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\installs\DivX502Bundle.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\RECYCLER\S-1-5-21-72185382-4212676017-31143968-1005\Dc122.exe infected by "not-a-virus:AdWare.WinAD.k" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-72185382-4212676017-31143968-1005\Dc123.dll infected by "not-a-virus:AdWare.WinAD.m" Virus. Action Taken: No Action Taken. File C:\WINDOWS\crwo.exe infected by "Backdoor.Win32.Small.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\DeskAdX.dll infected by "not-a-virus:AdWare.WinAD.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\SAHAgent_.exe infected by "not-a-virus:AdWare.ShopAtHome.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\SahHtml_.exe infected by "not-a-virus:AdWare.Sahat.i" Virus. Action Taken: No Action Taken. File C:\WINDOWS\n_iprbok.log infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mqexdlm.srg infected by "not-a-virus:AdWare.ToolBar.Exact" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.ToolBar.Exact" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\SahHtml.exe infected by "not-a-virus:AdWare.Sahat.i" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wolngeoj.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken. File C:\WINDOWS\crwo.exe infected by "Backdoor.Win32.Small.dc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\DeskAdX.dll infected by "not-a-virus:AdWare.WinAD.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\SAHAgent_.exe infected by "not-a-virus:AdWare.ShopAtHome.b" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\SahHtml_.exe infected by "not-a-virus:AdWare.Sahat.i" Virus. Action Taken: No Action Taken. File C:\WINDOWS\n_iprbok.log infected by "Trojan-Downloader.Win32.Agent.bc" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\mqexdlm.srg infected by "not-a-virus:AdWare.ToolBar.Exact" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.ToolBar.Exact" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\SahHtml.exe infected by "not-a-virus:AdWare.Sahat.i" Virus. Action Taken: No Action Taken. File C:\WINDOWS\wolngeoj.exe infected by "Trojan-Downloader.Win32.IstBar.go" Virus. Action Taken: No Action Taken. Fri Feb 11 21:08:43 2005 => ***** Scanning complete. ***** Fri Feb 11 21:08:43 2005 => Total Files Scanned: 65090 Fri Feb 11 21:08:43 2005 => Total Virus(es) Found: 42 Fri Feb 11 21:08:43 2005 => Total Disinfected Files: 0 Fri Feb 11 21:08:43 2005 => Total Files Renamed: 0 Fri Feb 11 21:08:43 2005 => Total Deleted Files: 0 Fri Feb 11 21:08:43 2005 => Total Errors: 259 Fri Feb 11 21:08:43 2005 => Time Elapsed: 03:17:47 Fri Feb 11 21:08:43 2005 => Virus Database Date: 2005/02/07 Fri Feb 11 21:08:43 2005 => Virus Database Count: 117359 Fri Feb 11 21:08:43 2005 => Scan Completed.
Post #35
My brother lives in Newton.
These are all bad, you can use the KillBox to delete them or which ever way you want.
Download and unzip the KillBox to a folder, just copy and paste each one in and hit delete. Any that won't delete, try the delete on reboot option or replace on reboot - use dummy.

C:\WINDOWS\crwo.exe
C:\WINDOWS\n_iprbok.log
C:\WINDOWS\wolngeoj.exe
C:\WINDOWS\crwo.exe
C:\WINDOWS\n_iprbok.log
C:\WINDOWS\wolngeoj.exe
C:\WINDOWS\crwo.exe
C:\WINDOWS\n_iprbok.log
C:\WINDOWS\wolngeoj.exe
C:\WINDOWS\system32\mac80ex.idf
C:\WINDOWS\system32\mqexdlm.srg
C:\WINDOWS\system32\netut80ex.vxd
C:\WINDOWS\system32\SahHtml.exe
C:\WINDOWS\system32\mac80ex.idf
C:\WINDOWS\system32\mqexdlm.srg
C:\WINDOWS\system32\netut80ex.vxd
C:\WINDOWS\system32\SahHtml.exe
C:\WINDOWS\system32\mac80ex.idf
C:\WINDOWS\system32\mqexdlm.srg
C:\WINDOWS\system32\netut80ex.vxd
C:\WINDOWS\system32\SahHtml.exe

C:\WINDOWS\Downloaded Program Files\DeskAdX.dll
C:\WINDOWS\Downloaded Program Files\SAHAgent_.exe
C:\WINDOWS\Downloaded Program Files\SahHtml_.exe
C:\WINDOWS\Downloaded Program Files\DeskAdX.dll
C:\WINDOWS\Downloaded Program Files\SAHAgent_.exe
C:\WINDOWS\Downloaded Program Files\SahHtml_.exe


C:\DOCUME~1\TIMS~1\LOCALS~1\TEMPOR~1\Content.IE5\QK4FPH8L\masta[1].htm

C:\Documents and Settings\Tim S\Local Settings\Temporary Internet Files\Content.IE5\QK4FPH8L\masta[1].htm

C:\Documents and Settings\Tim S\My Documents\Kaza\kmd160_en.exe
C:\RECYCLER\S-1-5-21-72185382-4212676017-31143968-1005\Dc122.exe
C:\RECYCLER\S-1-5-21-72185382-4212676017-31143968-1005\Dc123.dll

Good Luck, MrC
Post #36
OK MrC, Done. Some of the files said they didn't exist, but I noticed a lot of repetition and were probably deleted in the beginning of the proceedure. Is this it? Am I clean? How do I set a restore point. Do I empty the recyle bin first? Do I empty just the bin or the protected files section to? Do I uncheck "turn-off system restore" now? Should I be browsing other folders for junk? I'm sitting idle with the system until further notice. No reboots yet. Let me know. Thanks! Tim
Post #37

Some of the files said they didn't exist, but I noticed a lot of repetition and were probably deleted in the beginning of the proceedure


OK, I missed that, there was some repetition.

Is this it? Am I clean? How do I set a restore point. Do I empty the recyle bin first? Do I empty just the bin or the protected files section to?


I hope so.

Do this:
The KillBox creates a folder called "submit" in C:\, find it and delete it.

Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files
Temporary Internet Files
Recycle Bin

Clean up as much as possible

Delete all files in these folders.(if they exist)
C:\documents and settings\(your name)\local settings\temp
C:\documents and settings\(anyone)\local settings\temp
C:\windows\temp
C:\Temp

Empty recycle bin.

Here's a couple of links that shows how to enable system restore again:
http://www.short-media.com/forum/showpost….ystem%20restore
XP system restore
MrC
Post #38
The cleanup went well. I do have a few questions, though. In C:\documents and settings\owner\local settings\temp I found Desktop.ini created Aug '01. When I went to delete it said it was a system file. Also, in C:\documents and settings\guest\local settings\temp I found the same file created May '03. Should I be tossing these? There are also 3 folders in C:\windows that are called AU Backup, AU Log, and AU Temp. Should these be there? They were created 2/3/05. Thanks, Tim
Post #39

In C:\documents and settings\owner\local settings\temp I found Desktop.ini created Aug '01. When I went to delete it said it was a system file. Also, in C:\documents and settings\guest\local settings\temp I found the same file created May '03. Should I be tossing these?


Yes, anything in the temp folders you can delete, you may have to use the KillBox.


There are also 3 folders in C:\windows that are called AU Backup, AU Log, and AU Temp. Should these be there? They were created 2/3/05.



These are from the http://housecall.trendmicro.com/housecall/start_corp.asp virus scan I had you run. I have the same files on my system. If you want you can delete them.


MrC
Post #41

I may have missed this in your post but, do I empty the protected bin as well?


Yes if you're talking about Nortons.
I may have told you this before, but the KillBox creates a folder in C:\ called !submit, you can delete it also.

MrC
Post #42
Mr Charlie, YOU ARE THE BEST! I am finally finished and my system hasn't run this well in years! I appreciate all you have done and I hope you, and the others on this site, can continue to help others that suffer from the unfortunate perils of system infection. If you ever need anything, just ask. I will be donating to this site for the support received. God Bless You. Sincerely, Tim
Post #43
As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Thanks, MrC

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI