Tom's Guide | Tom's Hardware | Tom's Games

Computing.Net > Forums > Security and Virus > b.exe virsus

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

b.exe virsus

Reply to Message Icon

Name: klye
Date: July 3, 2009 at 19:08:35 Pacific
OS: Windows XP
Subcategory: Viruses
Comment:

So, it looks like I have the b.exe virsus. Can you all help me?

Here's what Hijack This brings up....
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:02:59 PM, on 7/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for

Windows\FPAVServer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\msa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SOUNDMAN.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for

Windows\FProtTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\Joe\LOCALS~1\Temp\b.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page

= http://staff.cccnj.net/~jdugan/
F2 - REG:system.ini: Shell=explorer.exe

"C:\Program Files\Common

Files\System\svchost.exe"
O2 - BHO: AcroIEHlprObj Class -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} -

C:\WINDOWS\system32\msxml71.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class -

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Codec pack - {b448d946-3623-42ab-ba32-c08651e36980} -

C:\Program Files\Common Files\System\sys_vd4.dat
O3 - Toolbar: DAEMON Tools Toolbar -

{32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program

Files\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program

Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [F-PROT Antivirus Tray application]

C:\Program Files\FRISK Software\F-PROT Antivirus for

Windows\FProtTray.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI

Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program

Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [DriverUpdaterPro] C:\Program Files\iXi

Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKCU\..\Run: [System Resource Monitor]

C:\DOCUME~1\Joe\LOCALS~1\Temp\srcmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON

Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Cognac] C:\DOCUME~1\Joe\LOCALS~1\Temp\b.exe
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [StartCCC] C:\Program Files\ATI

Technologies\ATI.ACE\Core-Static\CLIStart.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program

Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program

Files\Microsoft Office\Office10\OSA.exe
O7 -

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System,

DisableRegedit=1
O7 -

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System,

DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.drivermax.com
O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic

Driver Installation Control) -

http://inst.c-wss.com/141p/html/gtd...
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -

http://www.fileplanet.com/fpdlmgr/c...
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl

Class) -

http://update.microsoft.com/windows...

client/wuweb_site.cab?1238204615203
O17 -

HKLM\System\CCS\Services\Tcpip\..\{E991E81B-D5AB-4F7B-A738-40B2

50444954}: NameServer = 192.168.1.1
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner -

C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-PROT Antivirus for Windows system (FPAVServer)

- FRISK Software International - C:\Program Files\FRISK

Software\F-PROT Antivirus for Windows\FPAVServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) -

Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SiSoftware Database Agent Service

(SandraDataSrv) - SiSoftware - C:\Program

Files\SiSoftware\SiSoftware Sandra Lite

XI.SP4a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) -

SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite

XI.SP4a\RpcSandraSrv.exe

--
End of file - 6330 bytes



Sponsored Link
Ads by Google

Response Number 1
Name: jdk (by neoark)
Date: July 3, 2009 at 19:21:03 Pacific
Reply:

upload C:\DOCUME~1\Joe\LOCALS~1\Temp\b.exe to virustotal.com paste link here.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 2
Name: klye
Date: July 4, 2009 at 06:07:35 Pacific
Reply:
0

Response Number 3
Name: jdk (by neoark)
Date: July 4, 2009 at 07:25:15 Pacific
Reply:

Download and run Kaspersky AVP tool: http://devbuilds.kaspersky-labs.com...
Once you download and start the tool:

# Check below options:

    * Select all the objects/places to be scanned. 

# Click Scan
# Fix what it detects
# Zip/Rar Scan log/Summary and upload it to rapidshare.com. Post download link in your next message.

Illustrated tutorial: http://img32.imageshack.us/img32/76...

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 4
Name: klye
Date: July 4, 2009 at 17:11:04 Pacific
Reply:

Some of the files it says it cannot disinfect, but does give me the option to delete the file. Should I just delete the files I cannot disinfect?


0

Response Number 5
Name: jdk (by neoark)
Date: July 4, 2009 at 17:14:56 Pacific
Reply:

Yes delete them. You will need windows CD if some of the windows files are infected.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Related Posts

See More



Response Number 6
Name: klye
Date: July 18, 2009 at 08:47:58 Pacific
Reply:
0

Response Number 7
Name: jdk (by neoark)
Date: July 18, 2009 at 09:11:39 Pacific
Reply:

Follow:

1) Install, update database and run full scan with Malwarebytes' Anti-Malware. Attach malwarebyte full scan log, fix anything detected.

2) Run full Scan with SuperAntispyware : http://www.superantispyware.com/dow... . Fix what it detects and post summary scan log.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 8
Name: klye
Date: July 18, 2009 at 20:37:49 Pacific
Reply:

Here's the link to the Malwarebytes scan log
http://rapidshare.com/files/2574265...

I ran SuperAntispyware, fixed what it detected. Can't find the logfile, but I rescaned after a boot up and found nothing new.


0

Response Number 9
Name: jdk (by neoark)
Date: July 18, 2009 at 20:41:52 Pacific
Reply:

Problem fixed? How is you machine now?

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Response Number 10
Name: klye
Date: July 19, 2009 at 06:04:40 Pacific
Reply:

Seems alright.
I've noticed that I can't turn on Microsofts Firewall.
I can't do it from the contel at least.


0

Response Number 11
Name: jdk (by neoark)
Date: July 19, 2009 at 06:09:44 Pacific
Reply:

Download ccleaner and run its temp and registry cleaner.

If I'm helping you and I don't reply within 24 hours send me a PM.


0

Sponsored Link
Ads by Google
Reply to Message Icon



Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home


Sponsored links
Ads by Google


Results for: b.exe virsus
b.exe error/virus PLEASE HELP www.computing.net/answers/security/bexe-errorvirus-please-help-/21385.html

b.exe/limewire problem www.computing.net/answers/security/bexelimewire-problem/21494.html

b.exe virus..buddypictures www.computing.net/answers/security/bexe-virusbuddypictures/18485.html