.dll or .exe

Secure Home | Search | About

Lost Password?

Microsoft Antivirus Discussions

get this group's latest topics as an RSS feed

add this group's latest topics to your My MSN content

add this group's latest topics to your My Yahoo content

add this group's latest topics to your Google content

Subject

Author

Date

.dll or .exe

pro0

08-25-2006

Malke

David H. Lipman

Posted by pro0 on August 25, 2006, 10:59 am

If you were Registered and logged in, you could reply and use other advanced thread options

Hi all

my antivirus software detects a file named "t<numbers>.dll" in folder
C:\Documents and Settings\<my_username>\local settings\temp\ .

It cannot delete it (Access Denied), when I look into that folder I see
a bunch of files "t<number>.exe" . There is no file with a .dll
extension. I can delete those files , but they keep reappearing and the
antivir keeps detecting the .dll file.

The antivirus describes this threat as "downloader"

I have tried to find what process creates those exe files, but no
success.

Any idea on what kind of threat has this behavior and how to get rid of
it?

Oh, my anti-spyware tools do not detect any problem, only the antivirus
does.

thanks

Posted by Malke on August 25, 2006, 12:41 pm

If you were Registered and logged in, you could reply and use other advanced thread options

pro0 wrote:

> Hi all

> my antivirus software detects a file named "t<numbers>.dll" in folder

> C:\Documents and Settings\<my_username>\local settings\temp\ .

> It cannot delete it (Access Denied), when I look into that folder I

> see a bunch of files "t<number>.exe" . There is no file with a .dll

> extension. I can delete those files , but they keep reappearing and

> the antivir keeps detecting the .dll file.

> The antivirus describes this threat as "downloader"

> I have tried to find what process creates those exe files, but no

> success.

> Any idea on what kind of threat has this behavior and how to get rid

> of it?

> Oh, my anti-spyware tools do not detect any problem, only the

> antivirus does.

Go through the preparatory steps from this link,
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with either Sysclean or Multi_AV, plus Ewido. Do all
prep/finishing work and follow instructions to do all scans in Safe
Mode.

Then do the general malware removal and finishing-up steps. When all
else fails, run HijackThis and post your log in one of the specialty
forums listed at the link above (not here, please).

If the procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a professional
computer repair shop (not your local version of BigStoreUSA).

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Posted by David H. Lipman on August 25, 2006, 4:46 pm

If you were Registered and logged in, you could reply and use other advanced thread options

| Hi all
|
| my antivirus software detects a file named "t<numbers>.dll" in folder
| C:\Documents and Settings\<my_username>\local settings\temp\ .
|
| It cannot delete it (Access Denied), when I look into that folder I see
| a bunch of files "t<number>.exe" . There is no file with a .dll
| extension. I can delete those files , but they keep reappearing and the
| antivir keeps detecting the .dll file.
|
| The antivirus describes this threat as "downloader"
|
| I have tried to find what process creates those exe files, but no
| success.
|
| Any idea on what kind of threat has this behavior and how to get rid of
| it?
|
| Oh, my anti-spyware tools do not detect any problem, only the antivirus
| does.
|
| thanks

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm

* * * Please report back your results * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

The site map in XML format XML site map