Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

cannot get rid of win32trojan-genvc &win32trojano389 [CLOSED]

Started by mystieyed , Dec 11 2005 10:39 PM

This topic is locked

#1
mystieyed

Posted 11 December 2005 - 10:39 PM

Member

Member
11 posts

I have tried using everything I can think of. My anti-virus can't delete it either! It says it cannot find path??
I also think it has deleted or corrupted some of my c drive files...Please help!!

This is my hijack this logfile;
Logfile of HijackThis v1.99.1
Scan saved at 10:34:39 PM, on 12/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\ISP.COM High Speed\slipcore.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\ISP.COM High Speed\slipgui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.centurytel.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://totalinternet...ernet-0,00.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5400
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {166D5965-3523-FD3D-7653-2DD44AC66EB8} - (no file)
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\ISP.COM High Speed\PBHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: ISP.COM High Speed - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\Program Files\ISP.COM High Speed\Toolband.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\ISP.COM High Speed\slipcore.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [CenturyTel] C:\PROGRA~1\CENTUR~1\FPTool.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: ISP.COM High Speed.lnk = C:\Program Files\ISP.COM High Speed\slipgui.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/327
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\ISP.COM High Speed\gui_resource.dll/328
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
O9 - Extra button: (no name) - {83D5556F-4224-4fc7-A578-4D09AAD5DED4} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - {83D5556F-4224-4fc7-A578-4D09AAD5DED4} - (no file) (HKCU)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing) (HKCU)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C89E4425-9E39-46EA-A0B9-CE801B50C20C}: NameServer = 204.157.3.13 205.137.48.5
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

:tazz:

#2
greyknight17

Posted 16 December 2005 - 09:05 PM

Malware Expert

Visiting Consultant
16,560 posts

That's not good...you have too many antivirus programs running there. Ewido and one other antivirus program can stay since Ewido is compatible with either. But decide whether want to keep Avast or AVG. Uninstall the other.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Check Ewido for any updates...

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Don't run it yet.

Restart your computer and boot into Safe Mode (if you don't know how, go to http://www.bleepingc...showtutorial=61 ).

CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

Now open Ewido and do a scan on your system.

* Click on scanner.
* Click on 'Complete System Scan' and the scan will begin.
* While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action on all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.
* Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'.
* Click 'Save report'.
* Save the report to your desktop.

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you check the last one:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {166D5965-3523-FD3D-7653-2DD44AC66EB8} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O9 - Extra button: (no name) - {83D5556F-4224-4fc7-A578-4D09AAD5DED4} - (no file)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing)
O9 - Extra button: (no name) - {83D5556F-4224-4fc7-A578-4D09AAD5DED4} - (no file) (HKCU)
O9 - Extra button: (no name) - {BE2F2769-8A63-4bc7-8A99-06C2C4AD7B9B} - C:\WINDOWS\System32\crtv2_32.dll (file missing) (HKCU)
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai....23/cpbrkpie.cab

Uninstall Viewpoint via the Add/Remove panel.

Locate and delete the following:

C:\Program Files\Viewpoint\
C:\WINDOWS\System32\crtv2_32.dll

Restart your computer. Post the logs for HijackThis and Ewido. Also do this:

Run a virus scan using Kapersky Online Scanner. Just click on the Kapersky Online Scanner button and read what's posted there - hit Accept once you're done. Download the ActiveX file when prompted. Scanning will begin shortly. When it's done post the log here.

#3
mystieyed

Posted 17 December 2005 - 01:20 AM

Member

Topic Starter
Member
11 posts

Thanks so much for the reply! I actually uninstalled AVG awhile ago but, there are still parts of it left on my puter..Not sure how to get it completely off??I tried to redownload and then repeat the uninstall but, it would not DL again..I figured I would get rid of this problem first..
I will try to do this tonight and finish tom night..
Thanks again very much! I appreciate your help..I am new at all of this

#4
mystieyed

Posted 17 December 2005 - 01:32 AM

Member

Topic Starter
Member
11 posts

Ewido is corrupted or was a bad download it says...it won't let me re-download..What the...? Should i use Ad-aware or avast instead?
Thanks

#5
greyknight17

Posted 17 December 2005 - 01:14 PM

Malware Expert

Visiting Consultant
16,560 posts

Please watch your language there...

Are you sure you uninstalled AVG? I'm asking because I see that it's clearly running in your processes. We will fix that up also:

Add this to the list of fixes:

Check and fix these in HijackThis:

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

sc stop Avg7Alrt
sc delete Avg7Alrt
sc stop Avg7UpdSvc
sc delete Avg7UpdSvc
del delete.bat

Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it.

For Ewido, didn't you install it already? I see it in your HijackThis log...

#6
mystieyed

Posted 17 December 2005 - 05:40 PM

Member

Topic Starter
Member
11 posts

Sorry about that..
Yes, I did but when I went to use it it would not work {Ewido}.so, I tried to uninstall and dl again..Alot of my programs are doing this..I have lost alot of them because all of the sudden it says cannot open or something along those lines..
I am not sure AVG is completely gone since when I start up it says cannot open AVG kernel??
But, I did uninstall or thought I did. It's not in my program list neither is ewido now.

#7
greyknight17

Posted 17 December 2005 - 08:33 PM

Malware Expert

Visiting Consultant
16,560 posts

Let's see if we can fix that problem with the other programs...

Go to Start->Run and type in sfc /scannow and hit OK. Let it scan. If it finds any files missing/corrupted, it may ask for the Windows CD. See if it finds anything...

Can you reinstall AVG or Ewido in Safe Mode?

Hopefully SFC will fix the problem you are having with installing them...

#8
mystieyed

Posted 17 December 2005 - 09:43 PM

Member

Topic Starter
Member
11 posts

says no files to display..
I will try to dl in safemode now

#9
greyknight17

Posted 17 December 2005 - 09:49 PM

Malware Expert

Visiting Consultant
16,560 posts

So SFC found nothing?

Download those programs now. Or if you want to do it in Safe Mode, do it in Safe Mode with Networking so you can go online. Then try to install them.

#10
mystieyed

Posted 17 December 2005 - 10:51 PM

Member

Topic Starter
Member
11 posts

ok, this is frustrating..safemode won't let me connect because I can't find it in network connections..I tried to add it and, it will only allow me to add a broadband connection..i have dial-up..It's like it's stuck!!
What should i do? Should i just re-download XP completely?

#11
greyknight17

Posted 18 December 2005 - 10:32 AM

Malware Expert

Visiting Consultant
16,560 posts

Are you just in Safe Mode ONLY or Safe Mode with Networking? Because the with Networking one should work...

#12
mystieyed

Posted 18 December 2005 - 05:27 PM

Member

Topic Starter
Member
11 posts

Yes, I tried both several times.
This puter is soooo messed up. Should i just re-download xp?

#13
greyknight17

Posted 18 December 2005 - 06:19 PM

Malware Expert

Visiting Consultant
16,560 posts

Re-download? You mean reinstall XP right? Hold off on it...for now.

Let's see if we can repair it first. Go to this site and follow the steps there to see if the repair option works. If not, then backup all your important data (including any favorites, emails, etc.) and then reinstall Windows from scratch.