Help =(

Viruses and worms
1

Ok so i somehow got a virus on my laptop and i dont know what else to do. Ive done scans like theres no tomorrow, and did get rid of some of the crap on my computer (rootkit?), i still cant seem to get rid of 8 files, (spyware-gen, Dialer-567 and they have [trj] at the end) . It says an error has occured and the operation is not supported by the archive. How can i get rid of the files, because when i scan those files it says their still infected.

Please help ??? im so confused and worried about my poor lil laptop

2

What is your AV you don’t say if you are even using avast ?
If so - What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections.

If trying to extract from an unsupported archive, e.g. the extraction might leave the archive corrupt or would potentially only have the option to delete the archive.

This is why the question on the file name and location is important.

3

Im using avast! 4.7 Home Edition
The infected files are:
C:\Documents and Settings\Gaby Contreras\Local Settings\Temporary Internet Files\Content.IE5\64UTRPSS\syswcc32[1].exe\whiehlpr.dll
C:\Documents and Settings\Gaby Contreras\Local Settings\Temporary Internet Files\Content.IE5\64UTRPSS\syswcc32[1].exe\whAgent.exe
C:\Documents and Settings\Gaby Contreras\Local Settings\Temp\syswcc32.exe\whiehlpr.dll
C:\Documents and Settings\Gaby Contreras\Local Settings\Temp\syswcc32.exe\webhdll.dll
C:\Documents and Settings\Gaby Contreras\Local Settings\Temp\syswcc32.exe\whInstaller.exe
C:\Documents and Settings\Gaby Contreras\Local Settings\Temp\syswcc32.exe\whAgent.exe
C:\Documents and Settings\Gaby Contreras\Local Settings\Temporary Internet Files\Content.IE5\64UTRPSS\syswcc32[1].exe\webhdll.dll
C:\Documents and Settings\Gaby Contreras\Local Settings\Temporary Internet Files\Content.IE5\64UTRPSS\syswcc32[1].exe\whInstaller.exe

4

Hi xsheenax55,

Use this tool to remove WebHancer: http://securityresponse.symantec.com/avcenter/FixWebHancer.exe

When you have de-installed Webhancer and removed all files related to Webhancer, download LSPFix to your desktop from here: http://download.bleepingcomputer.com/spyware/lspfix.zip

Manually look for these files and delete from C::

c:\program files\webhancer
c:\windows\webhdll.dll
c:\windows\whagent.inf
c:\windows\whInstaller.exe
c:\windows\whInstaller.ini

You may have lost your Internet connection, run LSPFix now, and restart and check your Internet connection,
Attach a hijackthislog to your next posting to see if all WebHancer files were removed:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

polonus

5

I Tried that WebHancer and it did the scan and didnt pick up anything, but when i did another avast! scan it keeps picking up the same files with the virus. When i try to look for the files in the C drive i cant find them anywhere, so im very confused now :-[

6

Start by clearing your Temporary Internet Files.

What files are you looking for ?
If it is the file name at the end of the detection (list you posted) you won’t find that because it is inside another file. So you need to look at the file name just before the indicated file, e.g. \syswcc32.exe\whiehlpr.dll, the exe file is the archive file which would be used to extract the whiehlpr.dll inside it.