W32.Spybot.Worm

bennos · 02-23-2006, 01:14 PM

After performing a full system scan with Norton Internet Security it has come up with a list of the following issues:
W32.Spybot.Worm
W32.Alcra.F
Adware.P2PNetworking...
and 4 other adware things

These are the problems I seem to be having with my PC:
1. Comes up with a Winlog.exe error message on start-up (this is apparently where the W32.Spybit.Worm is found to be infecting). I can't find Winlog.exe anywhere. It is suppose to in the System32 folder.
2. Shareaza keeps loading by itself, after closing it down.
3. Task Manager doesn't work.
4. I can't run Norton AV, it just doesn't open at all.
5. A double beeping sound come on every now and then.

I have also completed a HijackThis log file but wanted to see if it can be resloved first without posting the attachment here.

I have been searching the forums here and at other sites for a solution and can't seem to find one that works. I've downloaded spyware/spybot software from forum advice and still nothing works. I'm starting to worry about my information getting into the wrong hands so I'm hoping to resolve this issue ASAP.

Any help would be greatly appreciated!!

Ben

**Buzz1927** · 02-23-2006, 01:54 PM

I think I know what's going on, but post the Hijackthis log to be sure.

bennos · 02-23-2006, 11:00 PM

Thanks for the reply Reaper. Unfortunately, my saved Hijackthis file is on the home PC and I'm at work at the moment. I will post it as soon as I get a chance to.

In the mean time, what do you think is going on?

**Buzz1927** · 02-23-2006, 11:05 PM

I think you might have a rootkit, and smitfaud as well, but I need to see the Hijackthis log before I advise you on what way to go.

bennos · 02-23-2006, 11:19 PM

Oh that doesn't sound healthy! Now, all I want to do is get home to get the file.

Is that something that can access my files (password file) and folders when I am connected to the internet?

**Buzz1927** · 02-23-2006, 11:24 PM

Quote:

Originally Posted by bennos

Oh that doesn't sound healthy! Now, all I want to do is get home to get the file.

Is that something that can access my files (password file) and folders when I am connected to the internet?

No, nothing to worry about, we'll get it when you get home.

bennos · 02-24-2006, 02:00 AM

Reaper. At home now. How else can I get the HijackThis file to you? It is over the allowable attachment size to add here.

bennos · 02-24-2006, 05:41 AM

Here is the HijackThis log file... Hope my issue is fixable!

Attachment 980

**Buzz1927** · 02-24-2006, 09:35 AM

Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.

When the sweep has finished, click Remove. Click Select All and then Next

Exit Spy Sweeper.

Run Hijackthis and select "Do a system scan only", place a check by the following entries.

O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O20 - AppInit_DLLs: acaptuser32.dll

Close all open windows and browsers, and hit "Fix Checked".

Delete these folders\files.

C:\Program Files\outlook
acaptuser32.dll

Restart your computer, and post a new Hijackthis log.

sidthereal · 02-24-2006, 09:38 AM

Edit: forget it

02-23-2006, 01:14 PM	#1 (permalink)
bennos Bronze Member Join Date: Sep 2004 Posts: 51	W32.Spybot.Worm - can't remove After performing a full system scan with Norton Internet Security it has come up with a list of the following issues: W32.Spybot.Worm W32.Alcra.F Adware.P2PNetworking... and 4 other adware things These are the problems I seem to be having with my PC: 1. Comes up with a Winlog.exe error message on start-up (this is apparently where the W32.Spybit.Worm is found to be infecting). I can't find Winlog.exe anywhere. It is suppose to in the System32 folder. 2. Shareaza keeps loading by itself, after closing it down. 3. Task Manager doesn't work. 4. I can't run Norton AV, it just doesn't open at all. 5. A double beeping sound come on every now and then. I have also completed a HijackThis log file but wanted to see if it can be resloved first without posting the attachment here. I have been searching the forums here and at other sites for a solution and can't seem to find one that works. I've downloaded spyware/spybot software from forum advice and still nothing works. I'm starting to worry about my information getting into the wrong hands so I'm hoping to resolve this issue ASAP. Any help would be greatly appreciated!! Ben

02-23-2006, 01:54 PM	#2 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 6,104	I think I know what's going on, but post the Hijackthis log to be sure. __________________ The Grim Reaper - Son of Glyndwr "To Hell or Connacht" may you burn in Hell tonight!

02-23-2006, 11:05 PM	#4 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 6,104	I think you might have a rootkit, and smitfaud as well, but I need to see the Hijackthis log before I advise you on what way to go. __________________ The Grim Reaper - Son of Glyndwr "To Hell or Connacht" may you burn in Hell tonight!

02-24-2006, 05:41 AM	#8 (permalink)
bennos Bronze Member Join Date: Sep 2004 Posts: 51	Here is the HijackThis log file... Hope my issue is fixable! Attachment 980 Last edited by bennos; 05-19-2007 at 08:58 AM.

02-24-2006, 09:35 AM	#9 (permalink)
Buzz1927 Digaredd Join Date: May 2005 Location: Melbourne AU Posts: 6,104	Download the trial version of Spy Sweeper from Here Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper) You will be prompted to check for updated definitions, please do so. (This may take several minutes) Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box. Click on Sweep and allow it to fully scan your system. When the sweep has finished, click Remove. Click Select All and then Next Exit Spy Sweeper. Run Hijackthis and select "Do a system scan only", place a check by the following entries. O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto O4 - HKLM\..\Run: [winlog] winlog.exe O4 - HKLM\..\RunServices: [winlog] winlog.exe O20 - AppInit_DLLs: acaptuser32.dll Close all open windows and browsers, and hit "Fix Checked". Delete these folders\files. C:\Program Files\outlook acaptuser32.dll Restart your computer, and post a new Hijackthis log. __________________ The Grim Reaper - Son of Glyndwr "To Hell or Connacht" may you burn in Hell tonight!

02-23-2006, 11:00 PM	#3 (permalink)
bennos Bronze Member Join Date: Sep 2004 Posts: 51	Thanks for the reply Reaper. Unfortunately, my saved Hijackthis file is on the home PC and I'm at work at the moment. I will post it as soon as I get a chance to. In the mean time, what do you think is going on?

02-23-2006, 11:19 PM	#5 (permalink)
bennos Bronze Member Join Date: Sep 2004 Posts: 51	Oh that doesn't sound healthy! Now, all I want to do is get home to get the file. Is that something that can access my files (password file) and folders when I am connected to the internet?

02-24-2006, 02:00 AM	#7 (permalink)
bennos Bronze Member Join Date: Sep 2004 Posts: 51	Reaper. At home now. How else can I get the HijackThis file to you? It is over the allowable attachment size to add here.

02-24-2006, 09:38 AM	#10 (permalink)
sidthereal Gold Member Join Date: Jun 2005 Posts: 263	Edit: forget it __________________ he who laughs last must have a terrible sense of humor :eek: Last edited by sidthereal; 02-24-2006 at 10:18 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode