Stupid Effin File Won't goooo awayyyyy

[huskeyb8]

Thanks! Wow I am learning some cool stuff here...again...Thanks.



Hope this works.
(fingers crossed)

[huskeyb8]

Ok..I followed all directions for putting the image link in between the img tags...but all I see in my reply is a box with a white square and red X in it. Please tell me you can see the hosted image?

[evilfantasy]

O1 - Hosts: 94.232.248.66 spydetect.microsoft.com
O1 - Hosts: 94.232.248.66 antivirwin2009.com
O1 - Hosts: 94.232.248.66 ww w.antivirwin2009.com
O18 - Filter hijack: text/html - {68265408-a6fc-4c72-8959-bdcf740e67ff} - (no file)

That's a sign that there is more malware to be taken care of.

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

Uninstall Boonty Games or Boonty from Add/Remove Programs.

----------

Download Unlocker by Cedrick Collomb

Be sure to uncheck the option to install the eBay shortcuts during the install.

• Open the installation file, select the installation language and click OK.
  
• An installation wizard will pop up, click Next.
  
• Choose the default destination folder C:\Programs Files\Unlocker and click Next.
  
• Click Install directly. (Don't change anything)
  
• After the installation completes, go back to the file/folder you want to delete.
• Right-click on the file/folder and select Unlocker.
  
• There should be a window opening, select Unlock all.
  
• Now you should be able to delete your file.

.
----------

If you already have Malwarebytes be sure to update it before running the scan!

Download Malwarebytes' Anti-Malware (MBAM)

Alternate MBAM download link

• Double-click mbam-setup.exe and follow the prompts to install the program.
  
• At the end, be sure a checkmark is placed next to the following:
• Update Malwarebytes' Anti-Malware
  
• Launch Malwarebytes' Anti-Malware

• Then click Finish.
  
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy and Paste the entire report in your next reply.

.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[huskeyb8]

I have Unlock and MBAM already installed. Checked in "add/remove programs" and boonty doesn't show up there.

[Rob Pomeroy]

Did we try renaming the file yet?  I know it was suggested...

[huskeyb8]

Sorry, it won't let me do anything att all...no rename, no delete, can't even drag it kivking and screaming into recycle bin.

I have never seen this before and I thought I was intelligent.

[kpac]

Evil, I'll leave it in your more than capable hands.

[huskeyb8]

Thanks for your help so far Kpac...Evil? will ya help me please?

[evilfantasy]

Open HijackThis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

Important: Close all windows except for HijackThis and then click Fix checked. Do not restart if prompted to by HijackThis.

Exit HijackThis.

----------

Go to Start > Run and type Notepad.exe then click OK.

Copy and paste the following text within the code box into the new Notepad file.

Code: [Select]

@ECHO OFF
sc stop "Boonty Games - BOONTY"
sc delete "Boonty Games - BOONTY"
sc stop "Boonty Games"
sc delete "Boonty Games"
exit
In Notepad select File and Save as
Choose the Save to location to be the Desktop and for the File name: type in fixme.bat making sure that the Save as type field says All files.

Next double click fixservice.bat to run it.
A black box should open and close after a short time, this is normal.
Do not continue until the black box has closed
Delete fixservice.bat from the Desktop.

----------

The file may be part of the malware. Lets do some cleanup first and then come back to it.

Update and run Malwarebytes, remove anything found. Post the log it creates please.

[evilfantasy]

Also when you post back let me know the entire file path of the file.

07-the_blind_boys_of_alabama-down_by_the_riverside_(with_the_preservation_hall_jazz_band_an d_allen_toussaint)

It should start with something like C:\ and end with the file extension. .mp3 or whatever it is.

[huskeyb8]

alrighty..be back in a few..and thanks.

[huskeyb8]

Here is the mbam post...nothing found or quarantined...

Malwarebytes' Anti-Malware 1.37
Database version: 2261
Windows 5.1.2600 Service Pack 2

6/12/2009 5:37:34 PM
mbam-log-2009-06-12 (17-37-34).txt

Scan type: Quick Scan
Objects scanned: 90695
Time elapsed: 5 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[huskeyb8]

Also when you post back let me know the entire file path of the file.

07-the_blind_boys_of_alabama-down_by_the_riverside_(with_the_preservation_hall_jazz_band_an d_allen_toussaint)

It should start with something like C:\ and end with the file extension. .mp3 or whatever it is.

Ok...I know what it SHOULD show...but fact is...it doesn't show either of those things. When I hold the pointer over the file name, a yellow box shows that says "Type:MP3 Audio File, Size:4.91MB" and that's all. And even more curious, when I hold the pointer over the main file the stubborn one is in, it says "File Empty" as if nothing is there at all.

[huskeyb8]

I myself found it quite amusing reading his initial post

Thanks Blockhead...I was just upset is all. Oh, and "he" is a she. LOL. Very unladylike of me..so again, I apologize to any that I DID offend.

[evilfantasy]

Enable viewing of hidden system files & folders XP

Go to My Computer->Tools->Folder Options->View tab:

• Under the Hidden files and folders heading:
• Select Show hidden files and folders.
  
• Uncheck Hide protected operating system files (recommended) option.
  
• Also, make sure there is no checkmark beside Hide file extensions for known file types.
  
• Click OK

----------

Now see if you can see the whole file path.