#1
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
[InActive] W32.ircbot.gen
When I start up my laptop (Vista) my Symantec scan finds the W32.IRCBOT.GEN and says it needs to take action but seems unable to remove it. I appears to be resident in the task manager. What would be a good way to approach removal? I have run Spybot Search and Destroy and Adaware with no success. I am including a HJT log. One other thing, each time I start up I get a prompt asking me to install System Cleaner 5. I downloaded the trial version and did not like it so I uninstalled but the prompt still comes up. I have checked Msconfig and did not find anything, so maybe that is in the HJT log as well. All I have to do is hit cancel and proceed but it is a pain to deal with. http://go.microsoft.com/fwlink/?LinkId=54896 http://www.toshibadirect.com/dpdstart http://www.toshibadirect.com/dpdstart http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://fpdownload2.macromedia.com/ge...sh/swflash.cab ms -help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Hi Herd72,RSIT by random/random and save it to your desktop.Double click RSIT.exe to start the tool.
At the disclaimer, please use the drop down box to select 3 months for the file/folder search, then click Continue.
If prompted to allow RSIT to access the internet, please allow it.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please post the contents of log.txt here in a new reply.
#3
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Sorry it took me so long to get back to you. I was traveling and did not have internet access there. Here is the Combofix log.TCP :C:\Program Files\Symantec AntiVirus\Rtvscan.exe:Symantec AntivirusTCP :C:\Program Files\Common Files\Symantec Shared\ccApp.exe:Symantec EmailTCP :6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office OutlookTCP :C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office GrooveTCP :C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNoteTCP :C:\Program Files\FrostWire\FrostWire.exe:FrostWireTCP traffic|js - STARTUP.HOMEPAGE - hxxp://www.msn.com/|http://www.wvmat.com/|http://marshal...px?n=633720891 http://www.gmer.net
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
I'm confused. Why did you run ComboFix? I asked for an RSIT log. here or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log.
#5
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Sorry for my incompetence and thanks for taking the time to answer! I did not realize that the UAC was even off. I kept hitting the link you posted and it kept taking me to the Combifix program so I thought that was the right one. I think one of my sons ran the Limewire thing but they moved out a year ago and it has not been used since. I will need to uninstall that thing too. I will take the steps you outlined and post the new log.
#6
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Here are the results
The Malwarebytes did not seem to find anything and it never asked me to restart so I am sending the log along with a fresh Hijack this.http://www.toshibadirect.com/dpdstart http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://fpdownload2.macromedia.com/ge...sh/swflash.cab ms -help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
#7
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Finally go the RSIT to work!
Here is the other log you first requested. Sorry again for the confusion.RAM : 2038 MB (51% free)http://www.toshibadirect.com/dpdstart http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://fpdownload2.macromedia.com/ge...sh/swflash.cab js - open - C:\Corel\Suite8\Programs\CCWin\Cscape.exeHD ---- C:\ProgramDataAD ---- C:\Windows\System32PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2006-11-02 200704]
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Please do an online scan with Kaspersky Online Scanner Accept , when prompted to download and install the program files and database of malware definitions.Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note** Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
#9
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Scanning now - will post log asap. The reason I could not get the RSIT thing going was the downloads were saving to a different folder and I did not find it for a while. I had downloaded it numerous times but was looking in the wrong folder.
#10
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Finally finished!
#11
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Here is the best that I could do on the HJT logfile. When I ran HJT I got an error message saying that the system was denying access to write to the log files. Anyway this is what it gave me and I hope it is complete.http://www.toshibadirect.com/dpdstart http://www.toshibadirect.com/dpdstart http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://fpdownload2.macromedia.com/ge...sh/swflash.cab ms -help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
#12
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Sorry for the delayed response Jim. I've been on the road the past couple of days.Evidence_Eliminator_6.01.rar Turbo_Subs.rar Archipelago.rar my submission channel by first clicking Browse, then after selecting a file, click Send File. Leave a link back to this topic please. Thanks!
#13
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
I deleted the files as you said and emptied the Norton Quarantine. Good grief, there are about 50 of those files,they like like applications and are from Pointstone. That was the program that kept trying to get me to install it. (System Cleaner 5) I had a friend that used the Pointstone Shredder (shareware) and I downloaded it to my other computer and have used it for a couple of years with zero issues to shred school documents. My wife is a teacher. The problem started when I downloaded the trial version on the System Cleaner 5 and did not like it and uninstalled it. It kept trying to get me to reinstall it on each bootup. I am submitting those files to your submission channel now.
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
They are all installers for System Cleaner 5. Delete them. Let me know if any return after a couple of reboots and some use.
#15
Senior Member
Profile: Join Date: Jun 2004
Location: West Virginia
Posts: 99
Computer Experience:
Will do. I have also enabled the UAC again.
All times are GMT +1. The time now is 20:41 .
